fix: Fix over-read and NULL deref in __hipstdpar_realloc#9372
Merged
Conversation
3 tasks
✅ All Checks Passed — Ready for Review
📖 Need help? See the Policy FAQ for details on every check and how to fix failures. |
|
🎉 All checks passed! This PR is ready for review. |
superm1
force-pushed
the
users/superm1/SWSPLAT-24298
branch
from
1fb0289 to
24558e4
Compare
Codecov Report✅ All modified and coverable lines are covered by tests. ❌ Your project status has failed because the head coverage (76.84%) is below the target coverage (80.00%). You can increase the head coverage or adjust the target coverage. Additional details and impacted files@@ Coverage Diff @@
## develop #9372 +/- ##
===========================================
- Coverage 64.60% 64.60% -0.00%
===========================================
Files 2686 2686
Lines 423252 423251 -1
Branches 62931 62932 +1
===========================================
- Hits 273421 273416 -5
- Misses 129157 129160 +3
- Partials 20674 20675 +1
*This pull request uses carry forward flags. Click here to find out more. 🚀 New features to boost your workflow:
|
superm1
changed the title
NguyenNhuDi
previously requested changes
Jul 14, 2026
amd-jmahovsky
approved these changes
Jul 14, 2026
amd-jmahovsky
left a comment
amd-jmahovsky
left a comment
Contributor
There was a problem hiding this comment.
LGTM, the core fix looks OK but I have a question about the test.
__hipstdpar_realloc copied n (the new size) bytes from the old pointer, over-reading past the end of the old block when growing an allocation. It also dereferenced the interposer Header for non-interposed pointers and passed a NULL pointer straight to memcpy on realloc(NULL, n). Clamp the copy to min(old_size, n), handle realloc(NULL, n) as malloc and realloc(p, 0) as free, and only decode the Header for managed allocations. The old size comes from the stored Header (v0) or malloc_usable_size (v1 and foreign pointers, when available). Fixes: SWSPLAT-24298 Co-Authored-By: Claude Opus 4 (1M context) <noreply@anthropic.com>
superm1
force-pushed
the
users/superm1/SWSPLAT-24298
branch
from
24558e4 to
4354192
Compare
assistant-librarian Bot
pushed a commit
to ROCm/rocThrust
that referenced
this pull request
Jul 15, 2026
fix: Fix over-read and NULL deref in __hipstdpar_realloc (#9372) __hipstdpar_realloc copied n (the new size) bytes from the old pointer, over-reading past the end of the old block when growing an allocation. It also dereferenced the interposer Header for non-interposed pointers and passed a NULL pointer straight to memcpy on realloc(NULL, n). Clamp the copy to min(old_size, n), handle realloc(NULL, n) as malloc and realloc(p, 0) as free, and only decode the Header for managed allocations. The old size comes from the stored Header (v0) or malloc_usable_size (v1 and foreign pointers, when available). JIRA ID: SWSPLAT-24298 Co-authored-by: Claude Opus 4 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
__hipstdpar_realloc copied n (the new size) bytes from the old pointer, over-reading past the end of the old block when growing an allocation. It also dereferenced the interposer Header for non-interposed pointers and passed a NULL pointer straight to memcpy on realloc(NULL, n).
Clamp the copy to min(old_size, n), handle realloc(NULL, n) as malloc and realloc(p, 0) as free, and only decode the Header for managed allocations. The old size comes from the stored Header (v0) or malloc_usable_size (v1 and foreign pointers, when available).
JIRA ID: SWSPLAT-24298