Skip to content

Commit 8f281f1

Browse files
committed
Fix out--of-bounds read in xlarrv functions
Memory access bound check is missing in slarrv, dlarrv, clarrv and zlarrv functions. Updated these functions to ensure array M is within range 0 <= M <= N Change-Id: I9a3b7af2399bc435abb2dab7dcdf41d5df12bf4c
1 parent 51d901f commit 8f281f1

4 files changed

Lines changed: 33 additions & 13 deletions

File tree

src/map/lapack2flamec/f2c/c/clarrv.c

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -255,6 +255,7 @@
255255
/* > he might be trading in precision when he decreases MINRGP. */
256256
/* > =-3: Problem in SLARRB when refining a single eigenvalue */
257257
/* > after the Rayleigh correction was rejected. */
258+
/* > =-4: M value exceeds N */
258259
/* > = 5: The Rayleigh Quotient Iteration failed to converge to */
259260
/* > full accuracy in MAXITR steps. */
260261
/* > \endverbatim */
@@ -395,9 +396,13 @@
395396
/* Function Body */
396397
*info = 0;
397398
/* Quick return if possible */
398-
if (*n <= 0) {
399-
AOCL_DTL_TRACE_EXIT(AOCL_DTL_LEVEL_TRACE_5);
400-
return 0;
399+
if ((*n <= 0) || (*m <= 0) || (*m > *n))
400+
{
401+
if (*m > *n)
402+
*info = -4;
403+
404+
AOCL_DTL_TRACE_EXIT(AOCL_DTL_LEVEL_TRACE_5);
405+
return 0;
401406
}
402407
/* The first N entries of WORK are reserved for the eigenvalues */
403408
indld = *n + 1;
@@ -1111,4 +1116,4 @@
11111116
/* End of CLARRV */
11121117
}
11131118
/* clarrv_ */
1114-
1119+

src/map/lapack2flamec/f2c/c/dlarrv.c

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -258,6 +258,7 @@
258258
/* > he might be trading in precision when he decreases MINRGP. */
259259
/* > =-3: Problem in DLARRB when refining a single eigenvalue */
260260
/* > after the Rayleigh correction was rejected. */
261+
/* > =-4: M value exceeds N */
261262
/* > = 5: The Rayleigh Quotient Iteration failed to converge to */
262263
/* > full accuracy in MAXITR steps. */
263264
/* > \endverbatim */
@@ -388,8 +389,12 @@
388389
/* Function Body */
389390
*info = 0;
390391
/* Quick return if possible */
391-
if (*n <= 0) {
392-
return 0;
392+
if ((*n <= 0) || (*m <= 0) || (*m > *n))
393+
{
394+
if (*m > *n)
395+
*info = -4;
396+
397+
return 0;
393398
}
394399
/* The first N entries of WORK are reserved for the eigenvalues */
395400
indld = *n + 1;
@@ -1059,4 +1064,4 @@
10591064
/* End of DLARRV */
10601065
}
10611066
/* dlarrv_ */
1062-
1067+

src/map/lapack2flamec/f2c/c/slarrv.c

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -258,6 +258,7 @@
258258
/* > he might be trading in precision when he decreases MINRGP. */
259259
/* > =-3: Problem in SLARRB when refining a single eigenvalue */
260260
/* > after the Rayleigh correction was rejected. */
261+
/* > =-4: M value exceeds N */
261262
/* > = 5: The Rayleigh Quotient Iteration failed to converge to */
262263
/* > full accuracy in MAXITR steps. */
263264
/* > \endverbatim */
@@ -383,8 +384,12 @@
383384
/* Function Body */
384385
*info = 0;
385386
/* Quick return if possible */
386-
if (*n <= 0) {
387-
return 0;
387+
if ((*n <= 0) || (*m <= 0) || (*m > *n))
388+
{
389+
if (*m > *n)
390+
*info = -4;
391+
392+
return 0;
388393
}
389394
/* The first N entries of WORK are reserved for the eigenvalues */
390395
indld = *n + 1;
@@ -1054,4 +1059,4 @@
10541059
/* End of SLARRV */
10551060
}
10561061
/* slarrv_ */
1057-
1062+

src/map/lapack2flamec/f2c/c/zlarrv.c

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -255,6 +255,7 @@
255255
/* > he might be trading in precision when he decreases MINRGP. */
256256
/* > =-3: Problem in DLARRB when refining a single eigenvalue */
257257
/* > after the Rayleigh correction was rejected. */
258+
/* > =-4: M value exceeds N */
258259
/* > = 5: The Rayleigh Quotient Iteration failed to converge to */
259260
/* > full accuracy in MAXITR steps. */
260261
/* > \endverbatim */
@@ -386,8 +387,12 @@
386387
/* Function Body */
387388
*info = 0;
388389
/* Quick return if possible */
389-
if (*n <= 0) {
390-
return 0;
390+
if ((*n <= 0) || (*m <= 0) || (*m > *n))
391+
{
392+
if (*m > *n)
393+
*info = -4;
394+
395+
return 0;
391396
}
392397
/* The first N entries of WORK are reserved for the eigenvalues */
393398
indld = *n + 1;
@@ -1095,4 +1100,4 @@
10951100
/* End of ZLARRV */
10961101
}
10971102
/* zlarrv_ */
1098-
1103+

0 commit comments

Comments
 (0)