Add overflow checks to getLeadingDims and getTrailingDims#19270
Add overflow checks to getLeadingDims and getTrailingDims#19270rascani wants to merge 4 commits into
Conversation
Summary: Add `c10::mul_overflows()` checks to the dimension-product loops in `getLeadingDims()` and `getTrailingDims()`. Both functions multiply tensor dimension sizes in a loop with no overflow protection. On 32-bit targets where `size_t` is 32 bits, malicious tensor dimensions from a crafted `.pte` file can cause the product to wrap silently, producing a small value that is then used for buffer offset calculations in 40+ kernels via `coordinateToIndex()`. This enables heap buffer overflows during operator execution. MACA-2026-001 (T267380210). Differential Revision: D103467782
🔗 Helpful Links🧪 See artifacts and rendered test results at hud.pytorch.org/pr/pytorch/executorch/19270
Note: Links to docs will display an error until the docs builds have been completed. ❌ 3 New FailuresAs of commit 9efe5d3 with merge base fa49f8f ( NEW FAILURES - The following jobs have failed:
This comment was automatically generated by Dr. CI and updates every 15 minutes. |
meta-cla
Bot
added
the
CLA Signed
|
@rascani has exported this pull request. If you are a Meta employee, you can view the originating Diff in D103467782. |
This PR needs a
|
|
@rascani has imported this pull request. If you are a Meta employee, you can view this in D103467782. |
|
Looks like this PR hasn't been updated in a while so we're going to go ahead and mark this as |
3 participants
Summary:
Add
c10::mul_overflows()checks to the dimension-product loops ingetLeadingDims()andgetTrailingDims().Both functions multiply tensor dimension sizes in a loop with no overflow protection. On 32-bit targets where
size_tis 32 bits, malicious tensor dimensions from a crafted.ptefile can cause the product to wrap silently, producing a small value that is then used for buffer offset calculations in 40+ kernels viacoordinateToIndex(). This enables heap buffer overflows during operator execution.MACA-2026-001 (T267380210).
Differential Revision: D103467782