Skip to content

Copybara import of the project: - #11586

Closed
copybara-service[bot] wants to merge 1 commit into
masterfrom
test_993240027
Closed

copybara-service[bot] wants to merge 1 commit into
masterfrom
test_993240027

Conversation

@copybara-service

Copy link
Copy Markdown
Contributor

Copybara import of the project:

--
1d17f75 by prasanna8585 65734642+prasanna8585@users.noreply.github.com:

Fix integer overflow in fully-connected-nc.c bias/kernel buffer sizing

output_channels * sizeof(xnn_float16) (xnn_create_fully_connected_nc_f16,
xnn_create_fully_connected_nc_pf16) and input_channels * output_channels *
sizeof(float) / output_channels * sizeof(float)
(xnn_create_fully_connected_nc_f32_f16, xnn_create_fully_connected_nc_pf32_f16)
were used directly as allocation sizes and write-loop bounds with no
overflow check, before any other parameter validation runs. On 32-bit
size_t targets this allows a caller-supplied channel count to wrap the
allocation size to a few bytes while the loop still writes/reads the real,
unwrapped count: heap-buffer-overflow write, plus an out-of-bounds read of
the caller-supplied bias array in the f16-bias case.

Guard all four sites with the existing xnn_safe_mul() helper, matching the
pattern already used for the main packed-weights buffer allocation
elsewhere in this file, returning xnn_status_invalid_parameter on overflow
instead of allocating an undersized buffer.

FUTURE_COPYBARA_INTEGRATE_REVIEW=#10935 from prasanna8585:fix/fully-connected-nc-output-channels-overflow fbb6b0d

--
1d17f75 by prasanna8585 <65734642+prasanna8585@users.noreply.github.com>:

Fix integer overflow in fully-connected-nc.c bias/kernel buffer sizing

output_channels * sizeof(xnn_float16) (xnn_create_fully_connected_nc_f16,
xnn_create_fully_connected_nc_pf16) and input_channels * output_channels *
sizeof(float) / output_channels * sizeof(float)
(xnn_create_fully_connected_nc_f32_f16, xnn_create_fully_connected_nc_pf32_f16)
were used directly as allocation sizes and write-loop bounds with no
overflow check, before any other parameter validation runs. On 32-bit
size_t targets this allows a caller-supplied channel count to wrap the
allocation size to a few bytes while the loop still writes/reads the real,
unwrapped count: heap-buffer-overflow write, plus an out-of-bounds read of
the caller-supplied bias array in the f16-bias case.

Guard all four sites with the existing xnn_safe_mul() helper, matching the
pattern already used for the main packed-weights buffer allocation
elsewhere in this file, returning xnn_status_invalid_parameter on overflow
instead of allocating an undersized buffer.

FUTURE_COPYBARA_INTEGRATE_REVIEW=#10935 from prasanna8585:fix/fully-connected-nc-output-channels-overflow fbb6b0d
PiperOrigin-RevId: 993240027
@copybara-service copybara-service Bot closed this Oct 13, 2026
@copybara-service
copybara-service Bot deleted the test_993240027 branch October 13, 2026 09:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant