Use compute_numel_overflow() in tensor_ptr builders#19076
Use compute_numel_overflow() in tensor_ptr builders#19076lucylq wants to merge 1 commit intogh/lucylq/156/basefrom
Conversation
make_tensor_ptr() and related extension builders return TensorPtr (a shared_ptr) and cannot propagate Error, so the existing compute_numel()*elementSize() size checks silently wrapped on overflow and let an undersized buffer back an oversized tensor (heap OOB). Migrate these callers to compute_numel_overflow() so overflow aborts, and add explicit c10::mul_overflows() guards around the subsequent numel*elementSize multiplication. Touched: make_tensor_ptr(vector<uint8_t>), clone_tensor_ptr, empty_strided, and the two tensor_ptr.h template overloads. Authored with Claude. Differential Revision: [D102082922](https://our.internmc.facebook.com/intern/diff/D102082922/) [ghstack-poisoned]
🔗 Helpful Links🧪 See artifacts and rendered test results at hud.pytorch.org/pr/pytorch/executorch/19076
Note: Links to docs will display an error until the docs builds have been completed. ❗ 1 Active SEVsThere are 1 currently active SEVs. If your PR is affected, please view them below: ❌ 3 New Failures, 2 Cancelled Jobs, 8 Unrelated FailuresAs of commit e8f2fca with merge base 069a793 ( NEW FAILURES - The following jobs have failed:
CANCELLED JOBS - The following jobs were cancelled. Please retry:
FLAKY - The following jobs failed but were likely due to flakiness present on trunk:
BROKEN TRUNK - The following jobs failed but were present on the merge base:👉 Rebase onto the `viable/strict` branch to avoid these failures
This comment was automatically generated by Dr. CI and updates every 15 minutes. |
This PR needs a
|
Stack from ghstack (oldest at bottom):
make_tensor_ptr() and related extension builders return TensorPtr (a shared_ptr) and cannot propagate Error, so the existing compute_numel()elementSize() size checks silently wrapped on overflow and let an undersized buffer back an oversized tensor (heap OOB). Migrate these callers to compute_numel_overflow() so overflow aborts, and add explicit c10::mul_overflows() guards around the subsequent numelelementSize multiplication. Touched: make_tensor_ptr(vector<uint8_t>), clone_tensor_ptr, empty_strided, and the two tensor_ptr.h template overloads.
Authored with Claude.
Differential Revision: D102082922