Commit 2f5bc1e
committed
fix: heap overflow in fit26 - x[1] written into a 1-element array
DecayFit26::fit writes the fitted fraction to x[0] and the complementary
fraction to x[1], but the Fit26 Python wrapper allocated a 1-element
parameter array (and the SWIG wrapper enforced exactly length 1), so every
fit26 call wrote 8 bytes past the numpy buffer. The overflow was absorbed
silently by allocator slack on macOS/Linux but corrupted the CRT heap on
Windows, crashing the test suite later with 0xc0000374 (detected in
whatever allocation-heavy code ran next).
The parameter array now has both slots, the SWIG wrapper requires at
least length 2, and the complementary fraction is returned to the caller.1 parent fbb3f63 commit 2f5bc1e
3 files changed
Lines changed: 10 additions & 5 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
17 | 17 | | |
18 | 18 | | |
19 | 19 | | |
20 | | - | |
| 20 | + | |
| 21 | + | |
| 22 | + | |
21 | 23 | | |
22 | | - | |
23 | | - | |
| 24 | + | |
| 25 | + | |
| 26 | + | |
24 | 27 | | |
25 | 28 | | |
26 | 29 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
365 | 365 | | |
366 | 366 | | |
367 | 367 | | |
368 | | - | |
| 368 | + | |
| 369 | + | |
| 370 | + | |
369 | 371 | | |
370 | 372 | | |
371 | 373 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
62 | 62 | | |
63 | 63 | | |
64 | 64 | | |
65 | | - | |
| 65 | + | |
66 | 66 | | |
67 | 67 | | |
68 | 68 | | |
| |||
0 commit comments