Skip to content

pddbtrsv potential buffer overrun #115

Description

@TLCFEM

The LWORK size is given here.

scalapack/SRC/pddbtrsv.f

Lines 128 to 132 in a23c2cd

* LWORK (local input or global input) INTEGER
* Size of user-input workspace WORK.
* If LWORK is too small, the minimal acceptable size will be
* returned in WORK(1) and an error code is returned. LWORK>=
* (max(bwl,bwu)*NRHS)

But in the following call, the size required is larger.

scalapack/SRC/pddbtrsv.f

Lines 1499 to 1500 in a23c2cd

CALL DLAMOV( 'N', BWU, NRHS, B( PART_OFFSET+ODD_SIZE+1 ),
$ LLDB, WORK( 1+MAX_BW-BWU ), MAX_BW+BWL )

Assuming the trailing MAX_BW + BWL - BWU elements are not accessed, this DLAMOV call requires the following size of WORK:

MAX_BW - BWU + ( MAX_BW + BWL ) * NRHS - MAX_BW - BWL + BWU
= MAX_BW * NRHS + BWL * ( NRHS - 1 )

The current implementation results in a buffer overrun.
A simple case can be reproduced using the following setting.

RANK = 2, N = 42, NRHS = 13, KL = 15, KU = 12, BLOCK = 30, LOCr(N) = 0
RANK = 0, N = 42, NRHS = 13, KL = 15, KU = 12, BLOCK = 30, LOCr(N) = 30
RANK = 1, N = 42, NRHS = 13, KL = 15, KU = 12, BLOCK = 30, LOCr(N) = 12

Maybe the minimum size shall be revised.
For simplicity, MAX_BW * ( 2 * NRHS - 1 ) or MAX_BW * 2 * NRHS.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Fields

    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions