Skip to content

Commit e2886cd

Browse files
committed
fix: resolve UB in batch_invert and logderivative OOB in debug builds
Two bugs causing nightly debug build SIGABRT (exit code 134): 1. batch_invert: reserve() + operator[] is UB — use resize() to properly allocate elements before indexing. 2. compute_logderivative_inverse: multithreaded path splits work by circuit_size but inverse_polynomial can be smaller, causing OOB span access. Clamp range to polynomial's actual data size.
1 parent cf1a239 commit e2886cd

File tree

2 files changed

+13
-9
lines changed

2 files changed

+13
-9
lines changed

barretenberg/cpp/src/barretenberg/ecc/fields/field_impl.hpp

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -419,10 +419,8 @@ void field<T>::batch_invert(C& coeffs) noexcept
419419
{
420420
const size_t n = coeffs.size();
421421

422-
std::vector<field> temporaries;
423-
std::vector<bool> skipped;
424-
temporaries.reserve(n);
425-
skipped.reserve(n);
422+
std::vector<field> temporaries(n);
423+
std::vector<bool> skipped(n);
426424

427425
field accumulator = one();
428426
for (size_t i = 0; i < n; ++i) {

barretenberg/cpp/src/barretenberg/honk/proof_system/logderivative_library.hpp

Lines changed: 11 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -59,11 +59,17 @@ void compute_logderivative_inverse(Polynomials& polynomials, auto& relation_para
5959
});
6060
inverse_polynomial.at(i) = denominator;
6161
}
62-
FF* ffstart = &inverse_polynomial.coeffs()[start];
63-
std::span<FF> to_invert(ffstart, end - start);
64-
// Compute inverse polynomial I in place by inverting the product at each row
65-
// Note: zeroes are ignored as they are not used anyway
66-
FF::batch_invert(to_invert);
62+
// Clamp to the polynomial's actual (non-virtual) data range; virtual zero elements need no inversion.
63+
const size_t actual_size = inverse_polynomial.size();
64+
const size_t clamped_start = std::min(start, actual_size);
65+
const size_t clamped_end = std::min(end, actual_size);
66+
if (clamped_start < clamped_end) {
67+
FF* ffstart = &inverse_polynomial.coeffs()[clamped_start];
68+
std::span<FF> to_invert(ffstart, clamped_end - clamped_start);
69+
// Compute inverse polynomial I in place by inverting the product at each row
70+
// Note: zeroes are ignored as they are not used anyway
71+
FF::batch_invert(to_invert);
72+
}
6773
};
6874
if constexpr (UseMultithreading) {
6975
parallel_for([&](const ThreadChunk& chunk) {

0 commit comments

Comments
 (0)