[KevinLee1231]

Four independent input-handling defects, each of which crashes or hangs yafu. They are unrelated to each other, so they are easy to review one at a time.

1. pp1 and trial read the wrong operand slots

Arguments are placed according to the declared arity in function_nargs[]: with arity na and k arguments supplied, the first argument lands in operands[na-k] and the last in operands[na-1]. Two cases disagreed with that table.

pp1 was declared with arity 3 while its case handles at most two arguments, so the shift was one slot off for every call shape. The case reads operands[0] and operands[1], so new_factorization() was handed an uninitialized mpz (0), and print_factors() then divided by the zero product of the resulting factor list. GMP raises SIGFPE, so every pp1 call died with exit 136:

printf 'pp1(18446744073709551617)\n' | yafu     -> SIGFPE

Declaring arity 2 puts both call shapes into the slots the case reads. trial had the mirror-image bug in its one-argument branch only: arity is 2, so a single argument sits in operands[1], but that branch passed operands[0] to new_factorization():

printf 'trial(15)\n' | yafu                    -> SIGFPE

The placement rule is now documented above the table so the next case does not have to rediscover it.

2. print_factors divides by a zero factor product

print_factors() builds prod from the factor list and divides flist->N by it without checking. A zero-valued factor makes prod zero, and GMP raises SIGFPE from mpz_tdiv_r, taking the program down with no diagnostic at all. That is exactly how the pp1/trial misplacement above presented itself - an uninitialized operand reached new_factorization(), was recorded as a factor, and the crash surfaced here:

#5 __gmpz_tdiv_r
#6 print_factors (fobj=...) at factor/factor_common.c:1431

The bogus list is now reported and the remainder bookkeeping is skipped, so a bad factor list becomes a visible error message rather than a signal. An empty list is unaffected (its product is 1), which is what the surrounding check already relies on.

3. Unbounded tiny-ecm retry in the siqs special-case path

check_specialcase() finishes inputs below 115 bits with tiny-qs, and when that leaves a composite behind it retries tiny-ecm in an unbounded loop. Tiny-ecm cannot always succeed: when every factor of the remaining composite is small enough that its curve group order divides the stage-1 exponent, each curve collapses to gcd == n, which the caller correctly rejects as trivial. 15 is such a case, and the loop spun on it at 100% CPU forever:

printf 'siqs(15)\n' | yafu      -> never returns

The retry is now bounded at 100 attempts, after which the job finishes with deterministic methods: trial division to 1e5 via zTrial(), then Pollard rho via brent_loop() for anything still composite. Both append to fobj->factors and reduce their own gmp_n the same way tiny-ecm did, so the surrounding code needs no change. A prime remainder is added to the factor list directly.

4. Inputs below the GNFS polynomial-search minimum

The polynomial-search parameter tables begin at 80 digits (params_deg4 in nfs_poly.c) and the search compares log10(n) against that bound, so an input needs at least 81 decimal digits. Below that get_default_params() returns without filling anything in, leaving stage2_norm at zero, and the msieve code underneath answers with error: stage 2 size bound not provided and exit(-1) - killing the program from an explicit nfs() call on a number that SIQS factors in a fraction of a second:

printf 'nfs(<60 digits>)\n' | yafu    -> exit 255

nfs() now checks the size against NFS_GNFS_POLY_MIN_DIGITS before starting a GNFS job and hands anything smaller to SIQS, the same fallback the crossover check below it already used. The crossover is about which method is faster; this is about which method is possible at all, so it is checked first:

nfs: input of size 60 is below the GNFS polynomial-search minimum of 81 digits, using siqs
... = 618970019642690137449562111 * 162259276829213363391578010288127

do_msieve_polyselect() additionally zero-initializes its parameter struct and returns with a message if the table left it empty. That keeps the same abort from coming back through any other route into poly search, and covers the far end of the range too - the struct was uninitialized stack memory before, so a guard on it could not have been relied on.

Testing

Built from source on Linux (GCC 16, make yafu) and checked with:

pp1(19327352823000000088046829527, 2) -> 2147483647 * 9000000000000000041
trial(15)                             -> 15 = 3 * 5
trial(3000018000027, 3000000)         -> 3 * 1000003 * 1000003
trial(18446744073709551617)           -> reports C20, no longer dies
siqs(15)                              -> 15 = 3 * 5
siqs(21)                              -> 21 = 3 * 7
siqs(18446744073709551617)            -> 274177 * 67280421310721

pp1 output stays probabilistic - a p+1 curve can degenerate to gcd == n - so a single-base call may legitimately report nothing.

GNFS itself is unaffected: an 83-digit job still completes end to end (polynomial search -> lattice sieving -> msieve filtering -> LA -> sqrt):

nfs(30000000000000000000000000000000000000047800000000000000000000000000000000000016459)
  = 100000000000000000000000000000000000000109 * 300000000000000000000000000000000000000151

I am putting together a separate change that adds a regression harness, so the reproductions above are manual for now. Happy to split this into four PRs if that is easier to review.

[bbuhrow]

Thank you for these fixes!