Integer overflow in PlatformMemoryAllocator::allocate()#18680
Integer overflow in PlatformMemoryAllocator::allocate()#18680
Conversation
🔗 Helpful Links🧪 See artifacts and rendered test results at hud.pytorch.org/pr/pytorch/executorch/18680
Note: Links to docs will display an error until the docs builds have been completed. ⏳ No Failures, 124 PendingAs of commit 55e646a with merge base 3d2c853 ( This comment was automatically generated by Dr. CI and updates every 15 minutes. |
meta-cla
bot
added
the
CLA Signed
This PR needs a
|
lucylq
changed the title
There was a problem hiding this comment.
Pull request overview
This PR fixes a potential integer overflow in PlatformMemoryAllocator::allocate() by validating size additions before calculating the total allocation size, preventing undersized allocations that could lead to out-of-bounds writes.
Changes:
- Add overflow-checked computation for
alloc_sizeusingc10::add_overflows. - Log and return
nullptrwhen an overflow is detected during allocation size calculation.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| #include <cinttypes> | ||
| #include <cstdint> | ||
|
|
||
| #include <c10/util/safe_numerics.h> |
There was a problem hiding this comment.
<c10/util/safe_numerics.h> is already included by executorch/runtime/core/memory_allocator.h, so this direct include is redundant here. Consider removing it to keep header dependencies minimal and reduce rebuild churn.
| #include <c10/util/safe_numerics.h> |
…UTORCH-26) Add overflow checking before computing the total allocation size (sizeof(AllocationNode) + size + alignment) in PlatformMemoryAllocator::allocate(). Previously, when this sum exceeded SIZE_MAX, it would wrap around to a small value, causing pal_allocate to allocate an undersized buffer. This could lead to subsequent out-of-bounds writes. The fix validates each addition step against SIZE_MAX and returns nullptr on overflow. This PR was authored with the assistance of Claude.
Add overflow checking before computing the total allocation size (sizeof(AllocationNode) + size + alignment) in PlatformMemoryAllocator::allocate().
Previously, when this sum exceeded SIZE_MAX, it would wrap around to a small value, causing pal_allocate to allocate an undersized buffer. This could lead to subsequent out-of-bounds writes. The fix validates each addition step against SIZE_MAX and returns nullptr on overflow.
This PR was authored with the assistance of Claude.
Test plan