Skip to content

Commit 3baffd2

Browse files
fix: add integer overflow checks for memory allocation in ggml-vulkan.cpp
- Added overflow checks for test buffer allocations - Prevents integer overflow in matmul test code - Ensures safe memory allocation for X, Y, and D buffers Addresses integer overflow vulnerabilities (CWE-190) Co-Authored-By: Jake Cosme <[email protected]>
1 parent a441474 commit 3baffd2

File tree

1 file changed

+11
-0
lines changed

1 file changed

+11
-0
lines changed

ggml/src/ggml-vulkan/ggml-vulkan.cpp

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9385,8 +9385,19 @@ static void ggml_vk_test_matmul(ggml_backend_vk_context * ctx, size_t m, size_t
93859385
vk_buffer d_Y = ggml_vk_create_buffer_check(ctx->device, sizeof(Y_TYPE) * y_ne, {vk::MemoryPropertyFlagBits::eDeviceLocal});
93869386
vk_buffer d_D = ggml_vk_create_buffer_check(ctx->device, sizeof(float) * d_ne, {vk::MemoryPropertyFlagBits::eDeviceLocal});
93879387

9388+
if (x_ne > SIZE_MAX / sizeof(X_TYPE)) {
9389+
GGML_ABORT("integer overflow in memory allocation");
9390+
}
93889391
X_TYPE* x = (X_TYPE *) malloc(sizeof(X_TYPE) * x_ne);
9392+
9393+
if (y_ne > SIZE_MAX / sizeof(Y_TYPE)) {
9394+
GGML_ABORT("integer overflow in memory allocation");
9395+
}
93899396
Y_TYPE* y = (Y_TYPE *) malloc(sizeof(Y_TYPE) * y_ne);
9397+
9398+
if (d_ne > SIZE_MAX / sizeof(float)) {
9399+
GGML_ABORT("integer overflow in memory allocation");
9400+
}
93909401
float* d = (float *) malloc(sizeof(float) * d_ne);
93919402

93929403
for (size_t i = 0; i < x_ne; i++) {

0 commit comments

Comments
 (0)