Fix integer overflow in program.cpp bounds checks #18662
Conversation
… TOB-EXECUTORCH-24) TOB-EXECUTORCH-17: In get_constant_buffer_data(), the bounds check `offset + nbytes <= size` can overflow when offset and nbytes are large. Replace with the overflow-safe pattern `offset <= size && nbytes <= size - offset`. TOB-EXECUTORCH-24: In Program::load(), the computation `segment_base_offset + segment_data_size` for the expected file size can overflow. Add an explicit overflow check before the addition to ensure the sum does not exceed SIZE_MAX. This PR was authored with the assistance of Claude.
🔗 Helpful Links🧪 See artifacts and rendered test results at hud.pytorch.org/pr/pytorch/executorch/18662
Note: Links to docs will display an error until the docs builds have been completed. ✅ You can merge normally! (2 Unrelated Failures)As of commit 033e1d8 with merge base ee92757 ( BROKEN TRUNK - The following jobs failed but were present on the merge base:👉 Rebase onto the `viable/strict` branch to avoid these failures
This comment was automatically generated by Dr. CI and updates every 15 minutes. |
meta-cla
bot
added
the
CLA Signed
This PR needs a
|
| segment_data_size); | ||
| size_t expected = segment_base_offset == 0 | ||
| ? program_size | ||
| : segment_base_offset + segment_data_size; |
There was a problem hiding this comment.
make sure this calculation doesn't overflow
lucylq
changed the title
There was a problem hiding this comment.
Pull request overview
This PR hardens program parsing in the runtime executor by making two size/bounds checks overflow-safe, preventing incorrect validation and potential out-of-bounds access when offsets/sizes are large.
Changes:
- Add an explicit overflow check before computing
segment_base_offset + segment_data_sizewhen validating the expected file size from the extended header. - Replace the potentially overflowing bounds check
offset + nbytes <= sizewith the overflow-safe patternoffset <= size && nbytes <= size - offsetfor constant segment accesses.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
17: In get_constant_buffer_data(), the bounds check
offset + nbytes <= sizecan overflow when offset and nbytes are large. Replace with the overflow-safe patternoffset <= size && nbytes <= size - offset.24: In Program::load(), the computation
segment_base_offset + segment_data_sizefor the expected file size can overflow. Add an explicit overflow check before the addition to ensure the sum does not exceed SIZE_MAX.This PR was authored with the assistance of Claude.