Add integer overflow checks in Program::LoadSegment#19268
Add integer overflow checks in Program::LoadSegment#19268rascani wants to merge 1 commit intopytorch:mainfrom
Conversation
Summary: Add overflow protection to pointer arithmetic in `LoadSegment()` and `load_mutable_subsegment_into()`. Three additions were unchecked: 1. `segment_base_offset_ + segment->offset()` in `LoadSegment()` (line 563) — a malicious `.pte` file can set `segment->offset()` near `UINT64_MAX`, wrapping the sum to a small value and causing the loader to read from an unintended file position. 2. `offset + size` in `load_mutable_subsegment_into()` — overflow before the bounds check against `segment->size()` would bypass the validation entirely. 3. `segment_base_offset_ + segment->offset() + offset` in `load_mutable_subsegment_into()` (line 649) — a triple addition with no overflow check on any intermediate result. Now computed in two validated steps. The overflow checks use the same `ET_CHECK_OR_RETURN_ERROR` pattern already established at lines 95-100 for the header-level segment validation. MACA-2026-001 (T266924552). Differential Revision: D103467784
🔗 Helpful Links🧪 See artifacts and rendered test results at hud.pytorch.org/pr/pytorch/executorch/19268
Note: Links to docs will display an error until the docs builds have been completed. ❌ 1 New Failure, 2 Unrelated FailuresAs of commit 066e3f8 with merge base a3dd0fa ( NEW FAILURE - The following job has failed:
BROKEN TRUNK - The following jobs failed but were present on the merge base:👉 Rebase onto the `viable/strict` branch to avoid these failures
This comment was automatically generated by Dr. CI and updates every 15 minutes. |
meta-cla
Bot
added
the
CLA Signed
|
@rascani has exported this pull request. If you are a Meta employee, you can view the originating Diff in D103467784. |
This PR needs a
|
1 participant
Summary:
Add overflow protection to pointer arithmetic in
LoadSegment()andload_mutable_subsegment_into().Three additions were unchecked:
segment_base_offset_ + segment->offset()inLoadSegment()(line 563) — a malicious.ptefile can setsegment->offset()nearUINT64_MAX, wrapping the sum to a small value and causing the loader to read from an unintended file position.offset + sizeinload_mutable_subsegment_into()— overflow before the bounds check againstsegment->size()would bypass the validation entirely.segment_base_offset_ + segment->offset() + offsetinload_mutable_subsegment_into()(line 649) — a triple addition with no overflow check on any intermediate result. Now computed in two validated steps.The overflow checks use the same
ET_CHECK_OR_RETURN_ERRORpattern already established at lines 95-100 for the header-level segment validation.MACA-2026-001 (T266924552).
Differential Revision: D103467784