fix(ptobc): support dense executed constants in v0#717
Draft
HecreReed wants to merge 1 commit into
Draft
Conversation
Codex Review该评论由 review 机器人自动更新。
Summary未检查到 PR #717 存在问题 FindingsNo issues found. |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request adds support for encoding and decoding dense constant attributes (DenseElementsAttr) in the ptobc tool, along with a corresponding roundtrip test. The code review identified critical security vulnerabilities in ptobc_decode_print.cpp where integer overflows could occur when multiplying numElements by byteLen during decoding and attribute reconstruction (for both integer and float types). These overflows could bypass size validation and lead to out-of-bounds reads, so the reviewer recommended adding overflow checks before performing the multiplications.
Comment on lines
+263
to
+265
| uint64_t numElements = shapedType.getNumElements(); | ||
| uint64_t byteLen = (bitWidth + 7) / 8; | ||
| return r.readBytes(size_t(numElements * byteLen)); |
There was a problem hiding this comment.
Security Vulnerability: Integer Overflow leading to Out-of-Bounds Read
When decoding a dense constant, numElements and byteLen are multiplied to determine the total number of bytes to read. If a maliciously crafted .ptobc file specifies an extremely large shape, this multiplication can overflow size_t. This causes r.readBytes to allocate and read a much smaller buffer than expected, which subsequently leads to out-of-bounds heap reads and potential crashes during attribute reconstruction.
To prevent this, we must check for integer overflow before performing the multiplication.
uint64_t numElements = shapedType.getNumElements();
uint64_t byteLen = (bitWidth + 7) / 8;
if (numElements > 0 && byteLen > SIZE_MAX / numElements)
throw std::runtime_error("dense const size overflow");
return r.readBytes(size_t(numElements * byteLen));
Comment on lines
+413
to
+415
| unsigned byteLen = (bitWidth + 7) / 8; | ||
| if (entry.denseBytes.size() != size_t(numElements) * byteLen) | ||
| throw std::runtime_error("ConstDenseBits integer byte_len mismatch"); |
There was a problem hiding this comment.
Security Vulnerability: Integer Overflow leading to Out-of-Bounds Read
Similarly to the decoding phase, we must guard against integer overflow when validating the byte length of integer dense constants during attribute reconstruction. If numElements * byteLen overflows size_t, the mismatch check can be bypassed, leading to out-of-bounds reads in the subsequent loop.
Add an overflow check before validating the buffer size.
Suggested change
| unsigned byteLen = (bitWidth + 7) / 8; | |
| if (entry.denseBytes.size() != size_t(numElements) * byteLen) | |
| throw std::runtime_error("ConstDenseBits integer byte_len mismatch"); | |
| unsigned byteLen = (bitWidth + 7) / 8; | |
| if (numElements > 0 && byteLen > SIZE_MAX / numElements) | |
| throw std::runtime_error("ConstDenseBits integer size overflow"); | |
| if (entry.denseBytes.size() != size_t(numElements) * byteLen) | |
| throw std::runtime_error("ConstDenseBits integer byte_len mismatch"); |
Comment on lines
+431
to
+433
| unsigned byteLen = (bitWidth + 7) / 8; | ||
| if (entry.denseBytes.size() != size_t(numElements) * byteLen) | ||
| throw std::runtime_error("ConstDenseBits float byte_len mismatch"); |
There was a problem hiding this comment.
Security Vulnerability: Integer Overflow leading to Out-of-Bounds Read
Similarly to the integer path, we must guard against integer overflow when validating the byte length of float dense constants during attribute reconstruction.
Add an overflow check before validating the buffer size.
Suggested change
| unsigned byteLen = (bitWidth + 7) / 8; | |
| if (entry.denseBytes.size() != size_t(numElements) * byteLen) | |
| throw std::runtime_error("ConstDenseBits float byte_len mismatch"); | |
| unsigned byteLen = (bitWidth + 7) / 8; | |
| if (numElements > 0 && byteLen > SIZE_MAX / numElements) | |
| throw std::runtime_error("ConstDenseBits float size overflow"); | |
| if (entry.denseBytes.size() != size_t(numElements) * byteLen) | |
| throw std::runtime_error("ConstDenseBits float byte_len mismatch"); |
Collaborator
Author
|
/run all |
|
已接收
页面会自动刷新，可以直接看当前阶段、排队情况和最近结果。 |
A3 板测失败
失败用例
|
A3 板测失败详情：PR #717syncall_binding
tprefetch_async_binding
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
DenseElementsAttrconstants in compact v0ptobcencodingtmrgsortexecuted constants withvector<4xi16>Validation
cmake --build /Users/laoda/pto/PTOAS/_pr_issue18_fix/build-ptobc --target ptobc -j4ctest --test-dir /Users/laoda/pto/PTOAS/_pr_issue18_fix/build-ptobc --output-on-failure -R 'ptobc_mrgsort_dense_const_v0_encode|ptobc_tstore_fp_v0_encode|ptobc_tdequant_v0_encode'/Users/laoda/pto/PTOAS/_pr_issue18_fix/build-ptobc/tools/ptobc/ptobc encode /Users/laoda/pto/PTOAS/_pr_issue18_fix/test/lit/pto/tmrgsort_executed_constant_emitc.pto -o /tmp/tmrgsort_executed_constant_emitc.ptobc