#849 Crash caused by a loop of current sources

[snzho]

A loop of current sources causes ngspice to crash. Repro circuit is attached.

--- a/ngspice-47/src/maths/ni/nireinit.c
+++ b/ngspice-47/src/maths/ni/nireinit.c
@@ -34,6 +34,16 @@
     }
 #endif


+    /* A node whose only incident branches contribute no matrix element
+     * (e.g. a bare current-source node with no admittance path) is not
+     * counted by SMPmatSize, yet the device load code still indexes the
+     * RHS by that node's equation number (bounded by CKTmaxEqNum).  Size
+     * the RHS vectors to cover every equation number so such a node
+     * cannot drive an out-of-bounds heap access in the load path (e.g.
+     * ISRCload writing CKTrhs[ISRCposNode]). */
+    if (size < ckt->CKTmaxEqNum)
+        size = ckt->CKTmaxEqNum;
+
     CKALLOC(CKTrhs,size+1,double);
     CKALLOC(CKTrhsOld,size+1,double);
     CKALLOC(CKTrhsSpare,size+1,double);