Skip to content

Commit a73a51f

Browse files
committed
fix: Concat axis=0 heap-buffer-overflow when input blobs have unequal spatial dimensions
Summary: When Concat (axis=0) received input blobs with different w/h/d (e.g. from Interp with a non-integer scale factor such as 15/7 ≈ 2.142857), two bugs caused out-of-bounds memory access: Bug A (dims==2, axis==0): the output buffer was allocated with the first blob's w instead of max(w), so bulk memcpy would read/write past the end of smaller blobs. Bug B (dims==3/4, axis==0): cstep of each source blob was assumed equal to that of the destination blob; a single memcpy over cstep*c elements would stride past the allocated region when blobs differed in w or h. Fix: allocate the output with max(w)/max(h)/max(d) across all inputs, then copy row-by-row using each blob's actual w as the copy length. Zero-initialise the output buffer with memset so padding columns beyond a blob's w are always well-defined. The same fix is applied to the generic path (concat.cpp) and the ARM-optimised path including the bf16/fp16 specialisation (concat_arm.cpp). New test cases (test_concat_10 – test_concat_13) cover dims==2/3/4 with unequal spatial sizes and the exact 15/7 scale edge case.
1 parent 371bbad commit a73a51f

File tree

3 files changed

+391
-142
lines changed

3 files changed

+391
-142
lines changed

0 commit comments

Comments
 (0)