This project is archived. Its data is read-only.
[core] Bounds check issue in `TensorImpl_cpu::copy` function with `offset` parameter
## Required prerequisites - [x] Make sure you've read the documentation. Your issue may be addressed there. - [x] Search the issue tracker and discussions to verify that this hasn't already been reported. +1 or comment there if it has. ## What commit version of aidge do you use - ``aidge_core``: dev ## Problem description The `TensorImpl_cpu::copy` function does not correctly account for the offset parameter when performing a bounds check. As a result, copying with a large offset can exceed the allocated capacity of the tensor, potentially leading to out-of-bounds access and undefined behavior. ## Reproducible example code Modifying `unit_tests/backend/Test_TensorImpl.cpp` allows reproducing this bug. ```c++ TEST_CASE("Tensor fill", "[TensorImpl][fill]") { SECTION("Instantiate batches independantly") { std::shared_ptr<Tensor> concatenatedTensor= std::make_shared<Tensor>(Array2D<int, 3, 5>{}); std::shared_ptr<Tensor> myTensor1 = std::make_shared<Tensor>(Array1D<int, 5>{{1,2,3,4,5}}); std::shared_ptr<Tensor> myTensor2 = std::make_shared<Tensor>(Array1D<int, 5>{{6,7,8,9,10}}); std::shared_ptr<Tensor> myTensor3 = std::make_shared<Tensor>(Array1D<int, 5>{{11,12,13,14,15}}); concatenatedTensor->getImpl()->copy(myTensor1->getImpl()->rawPtr(), 5, 0); concatenatedTensor->getImpl()->copy(myTensor2->getImpl()->rawPtr(), 5, 5); concatenatedTensor->getImpl()->copy(myTensor3->getImpl()->rawPtr(), 5, 20); // ^ instead of 10. std::shared_ptr<Tensor> expectedTensor= std::make_shared<Tensor>(Array2D<int, 3, 5>{ {{1,2,3,4,5}, {6,7,8,9,10}, {11,12,13,14,15}} }); REQUIRE(*concatenatedTensor == *expectedTensor); } } ```
issue

Copyright © Eclipse Foundation AISBL. All rights reserved.     Privacy Policy | Terms of Use | Copyright Agent