Skip to content

cap trace value memcpy at scalar value size#9236

Open
Nashit-h wants to merge 1 commit into
halide:mainfrom
Nashit-h:trace-value-memcpy-cap
Open

cap trace value memcpy at scalar value size#9236
Nashit-h wants to merge 1 commit into
halide:mainfrom
Nashit-h:trace-value-memcpy-cap

Conversation

@Nashit-h

Copy link
Copy Markdown

get_value_as in HalideTraceViz.cpp and Packet::get_value_as in HalideTraceUtils.h copy type.bits / 8 bytes of a trace value into a fixed 8-byte halide_scalar_value_t, but type.bits comes straight from the packet header in the trace stream. A crafted load/store packet declaring a scalar type wider than 64 bits makes the memcpy write up to 31 bytes into the 8-byte local, overflowing the stack before value_as ever checks the type. Cap the copy at sizeof(halide_scalar_value_t) at both sites; valid types (bits <= 64) copy exactly as before.

Checklist

  • Tests added or updated (not required for docs, CI config, or typo fixes)
  • Documentation updated (if public API changed)
  • Python bindings updated (if public API changed)
  • Benchmarks are included here if the change is intended to affect performance.
  • Commits include AI attribution where applicable (see Code of Conduct)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants