Bounds check issue in `TensorImpl_cpu::copy` function with `offset` parameter
Required prerequisites
-
Make sure you've read the documentation. Your issue may be addressed there. -
Search the issue tracker and discussions to verify that this hasn't already been reported. +1 or comment there if it has.
What commit version of aidge do you use
-
aidge_core
: dev
Problem description
The TensorImpl_cpu::copy
function does not correctly account for the offset parameter when performing a bounds check. As a result, copying with a large offset can exceed the allocated capacity of the tensor, potentially leading to out-of-bounds access and undefined behavior.
Reproducible example code
Modifying unit_tests/backend/Test_TensorImpl.cpp
allows reproducing this bug.
TEST_CASE("Tensor fill", "[TensorImpl][fill]") {
SECTION("Instantiate batches independantly") {
std::shared_ptr<Tensor> concatenatedTensor= std::make_shared<Tensor>(Array2D<int, 3, 5>{});
std::shared_ptr<Tensor> myTensor1 = std::make_shared<Tensor>(Array1D<int, 5>{{1,2,3,4,5}});
std::shared_ptr<Tensor> myTensor2 = std::make_shared<Tensor>(Array1D<int, 5>{{6,7,8,9,10}});
std::shared_ptr<Tensor> myTensor3 = std::make_shared<Tensor>(Array1D<int, 5>{{11,12,13,14,15}});
concatenatedTensor->getImpl()->copy(myTensor1->getImpl()->rawPtr(), 5, 0);
concatenatedTensor->getImpl()->copy(myTensor2->getImpl()->rawPtr(), 5, 5);
concatenatedTensor->getImpl()->copy(myTensor3->getImpl()->rawPtr(), 5, 20);
// ^ instead of 10.
std::shared_ptr<Tensor> expectedTensor= std::make_shared<Tensor>(Array2D<int, 3, 5>{
{{1,2,3,4,5},
{6,7,8,9,10},
{11,12,13,14,15}}
});
REQUIRE(*concatenatedTensor == *expectedTensor);
}
}