Commit a73a51f
committed
fix: Concat axis=0 heap-buffer-overflow when input blobs have unequal spatial dimensions
Summary:
When Concat (axis=0) received input blobs with different w/h/d (e.g. from
Interp with a non-integer scale factor such as 15/7 ≈ 2.142857), two bugs
caused out-of-bounds memory access:
Bug A (dims==2, axis==0): the output buffer was allocated with the first
blob's w instead of max(w), so bulk memcpy would read/write past the end
of smaller blobs.
Bug B (dims==3/4, axis==0): cstep of each source blob was assumed equal to
that of the destination blob; a single memcpy over cstep*c elements would
stride past the allocated region when blobs differed in w or h.
Fix: allocate the output with max(w)/max(h)/max(d) across all inputs, then
copy row-by-row using each blob's actual w as the copy length. Zero-initialise
the output buffer with memset so padding columns beyond a blob's w are always
well-defined. The same fix is applied to the generic path (concat.cpp) and the
ARM-optimised path including the bf16/fp16 specialisation (concat_arm.cpp).
New test cases (test_concat_10 – test_concat_13) cover dims==2/3/4 with
unequal spatial sizes and the exact 15/7 scale edge case.1 parent 371bbad commit a73a51f
File tree
3 files changed
+391
-142
lines changed- src/layer
- arm
- tests
3 files changed
+391
-142
lines changed
0 commit comments