Add overflow checks to getLeadingDims and getTrailingDims#19270
Add overflow checks to getLeadingDims and getTrailingDims#19270rascani wants to merge 2 commits intopytorch:mainfrom
Conversation
Summary: Add `c10::mul_overflows()` checks to the dimension-product loops in `getLeadingDims()` and `getTrailingDims()`. Both functions multiply tensor dimension sizes in a loop with no overflow protection. On 32-bit targets where `size_t` is 32 bits, malicious tensor dimensions from a crafted `.pte` file can cause the product to wrap silently, producing a small value that is then used for buffer offset calculations in 40+ kernels via `coordinateToIndex()`. This enables heap buffer overflows during operator execution. MACA-2026-001 (T267380210). Differential Revision: D103467782
🔗 Helpful Links🧪 See artifacts and rendered test results at hud.pytorch.org/pr/pytorch/executorch/19270
Note: Links to docs will display an error until the docs builds have been completed. ❌ 2 New Failures, 2 Unrelated FailuresAs of commit 34ef14d with merge base a3dd0fa ( NEW FAILURES - The following jobs have failed:
BROKEN TRUNK - The following jobs failed but were present on the merge base:👉 Rebase onto the `viable/strict` branch to avoid these failures
This comment was automatically generated by Dr. CI and updates every 15 minutes. |
meta-cla
Bot
added
the
CLA Signed
|
@rascani has exported this pull request. If you are a Meta employee, you can view the originating Diff in D103467782. |
This PR needs a
|
2 participants
Summary:
Add
c10::mul_overflows()checks to the dimension-product loops ingetLeadingDims()andgetTrailingDims().Both functions multiply tensor dimension sizes in a loop with no overflow protection. On 32-bit targets where
size_tis 32 bits, malicious tensor dimensions from a crafted.ptefile can cause the product to wrap silently, producing a small value that is then used for buffer offset calculations in 40+ kernels viacoordinateToIndex(). This enables heap buffer overflows during operator execution.MACA-2026-001 (T267380210).
Differential Revision: D103467782