Skip to content

[core] Bounds check issue in `TensorImpl_cpu::copy` function with `offset` parameter

Required prerequisites

  • Make sure you've read the documentation. Your issue may be addressed there.
  • Search the issue tracker and discussions to verify that this hasn't already been reported. +1 or comment there if it has.

What commit version of aidge do you use

  • aidge_core: dev

Problem description

The TensorImpl_cpu::copy function does not correctly account for the offset parameter when performing a bounds check. As a result, copying with a large offset can exceed the allocated capacity of the tensor, potentially leading to out-of-bounds access and undefined behavior.

Reproducible example code

Modifying unit_tests/backend/Test_TensorImpl.cpp allows reproducing this bug.

TEST_CASE("Tensor fill", "[TensorImpl][fill]") {
  SECTION("Instantiate batches independantly") {
    std::shared_ptr<Tensor> concatenatedTensor= std::make_shared<Tensor>(Array2D<int, 3, 5>{});

    std::shared_ptr<Tensor> myTensor1 = std::make_shared<Tensor>(Array1D<int, 5>{{1,2,3,4,5}});
    std::shared_ptr<Tensor> myTensor2 = std::make_shared<Tensor>(Array1D<int, 5>{{6,7,8,9,10}});
    std::shared_ptr<Tensor> myTensor3 = std::make_shared<Tensor>(Array1D<int, 5>{{11,12,13,14,15}});

    concatenatedTensor->getImpl()->copy(myTensor1->getImpl()->rawPtr(), 5, 0);
    concatenatedTensor->getImpl()->copy(myTensor2->getImpl()->rawPtr(), 5, 5);
    concatenatedTensor->getImpl()->copy(myTensor3->getImpl()->rawPtr(), 5, 20); 
    //                                                                     ^ instead of 10.

    std::shared_ptr<Tensor> expectedTensor= std::make_shared<Tensor>(Array2D<int, 3, 5>{
      {{1,2,3,4,5},
      {6,7,8,9,10},
      {11,12,13,14,15}}
    });

    REQUIRE(*concatenatedTensor == *expectedTensor);
  }
}