Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix memory access out of bounds in numpy + chrome 89 #1474

Merged
merged 23 commits into from
Apr 17, 2021
Merged

Fix memory access out of bounds in numpy + chrome 89 #1474

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
23 commits
Select commit Hold shift + click to select a range
8fb7a70
Another numpy patch
Apr 15, 2021
f5ba767
Fix compile error
Apr 15, 2021
3b50bd9
Another try at patching PyArray_Broadcast
Apr 15, 2021
9c50394
Try again with correct type for it_ptr
Apr 15, 2021
2426e95
Add missing semicolon
Apr 15, 2021
3267a8e
Attempt 3
Apr 15, 2021
8d15840
Forgot some semicolons
Apr 15, 2021
e422021
Fix memory proxy macros / functions
Apr 15, 2021
0e30a22
Yet aanother attempt
Apr 16, 2021
cb8c23e
Fix ReferenceError
Apr 16, 2021
d7caf6c
Fix reference errors
Apr 16, 2021
215112f
Okay I think this works now?
Apr 16, 2021
9797c1d
Define PyArray_Broadcast_part1 when not compiling with __EMSCRIPTEN__
Apr 16, 2021
e5fbf97
Fix compile errors
Apr 16, 2021
e0ba4be
Fix native build error
Apr 16, 2021
f29f041
Cleanup
Apr 16, 2021
0cae03c
Finish cleanup
Apr 16, 2021
3ceb249
Update comment
Apr 16, 2021
0b9b738
Remove old patch
Apr 16, 2021
24e8698
Fix commented original function
Apr 16, 2021
1f9727c
Tiny cleanup of patch
Apr 16, 2021
630cd04
Fix patch
Apr 16, 2021
c26d66f
Fix ReferenceError
Apr 16, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Fix ReferenceError
  • Loading branch information
Hood committed Apr 16, 2021
commit cb8c23ed1d88c0b5e829d80e2d52d12253ea4884
31 changes: 28 additions & 3 deletions packages/numpy/patches/0001-temp.patch
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,12 +1,37 @@
From 406f26be6c693603f266d58220ac28b388f2a93a Mon Sep 17 00:00:00 2001
From f24c0d34b632f7005b6787bdbaca73a2bae03d54 Mon Sep 17 00:00:00 2001
From: Hood <hood@mit.edu>
Date: Thu, 15 Apr 2021 21:14:55 -0700
Subject: [PATCH] temp

---
numpy/core/src/multiarray/iterators.c | 35 ++++-----------------------
1 file changed, 5 insertions(+), 30 deletions(-)
numpy/core/src/multiarray/conversion_utils.c | 5 +--
numpy/core/src/multiarray/iterators.c | 35 +++-----------------
2 files changed, 8 insertions(+), 32 deletions(-)

diff --git a/numpy/core/src/multiarray/conversion_utils.c b/numpy/core/src/multiarray/conversion_utils.c
index 52cb58726..5467f4d78 100644
--- a/numpy/core/src/multiarray/conversion_utils.c
+++ b/numpy/core/src/multiarray/conversion_utils.c
@@ -955,9 +955,9 @@ PyArray_IntpFromIndexSequence(PyObject *seq, npy_intp *vals, npy_intp maxvals)
return -1;
}

- vals[i] = PyArray_PyIntAsIntp(op);
+ npy_intp x = PyArray_PyIntAsIntp(op);
Py_DECREF(op);
- if(vals[i] == -1) {
+ if(x == -1) {
err = PyErr_Occurred();
if (err &&
PyErr_GivenExceptionMatches(err, PyExc_OverflowError)) {
@@ -968,6 +968,7 @@ PyArray_IntpFromIndexSequence(PyObject *seq, npy_intp *vals, npy_intp maxvals)
return -1;
}
}
+ vals[i] = x;
}
}
return nd;
diff --git a/numpy/core/src/multiarray/iterators.c b/numpy/core/src/multiarray/iterators.c
index 9da811f69..f723c7646 100644
--- a/numpy/core/src/multiarray/iterators.c
Expand Down
30 changes: 15 additions & 15 deletions src/core/PyArray_Broadcast.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,50 +18,50 @@ EM_JS_NUM(int, PyArray_Broadcast_part1, (void* mit), {
let it;
let it_ptr;

let numiter = _HEAP32[(mit + 8) / 4];
let numiter = HEAP32[(mit + 8) / 4];
/* Discover the broadcast number of dimensions */
nd = 0;
for (i = 0; i < numiter; i++) {
// nd = PyArray_MAX(nd, PyArray_NDIM(mit->iters[i]->ao));
let it = _HEAP32[(mit + 152 + 4 * i) / 4];
let it = HEAP32[(mit + 152 + 4 * i) / 4];
// Look up ao
let it_ao = _HEAP32[(res + 660) / 4];
let it_ao = HEAP32[(res + 660) / 4];
// look up NDIM
let it_ao_ndim = _HEAP32[(res + 12) / 4];
let it_ao_ndim = HEAP32[(res + 12) / 4];
nd = (res > nd) ? res : nd;
}
// mit->nd = nd;
_HEAP32[(mit + 20) / 4] = nd;
HEAP32[(mit + 20) / 4] = nd;

/* Discover the broadcast shape in each dimension */
// for (i = 0; i < nd; i++) {
// mit->dimensions[i] = 1;
// }
_HEAP32.subarray((mit + 24) / 4, (mit + 24 + nd) / 4).fill(1);
HEAP32.subarray((mit + 24) / 4, (mit + 24 + nd) / 4).fill(1);

for (j = 0; j < numiter; j++) {
// it = mit->iters[i];
it = _HEAP32[(mit + 4 * j + 152) / 4];
it = HEAP32[(mit + 4 * j + 152) / 4];
for (i = 0; i < nd; i++) {
/* This prepends 1 to shapes not already equal to nd */
// k = i + PyArray_NDIM(it->ao) - nd;
let it_ao = _HEAP32[(it + 660) / 4];
let it_ao_ndim = _HEAP32[(ao + 12) / 4];
let it_ao = HEAP32[(it + 660) / 4];
let it_ao_ndim = HEAP32[(ao + 12) / 4];
let k = i + it_ao_ndim - nd;
if (k >= 0) {
// tmp = PyArray_DIMS(it->ao)[k];
let it_dims = _HEAP32[(it_ao + 16) / 4];
let it_dims_k = _HEAP32[(it_dims + 4 * k) / 4];
let it_dims = HEAP32[(it_ao + 16) / 4];
let it_dims_k = HEAP32[(it_dims + 4 * k) / 4];
if (it_dims_k == 1) {
continue;
}
// &mit->dimensions[i];
let mit_dim_i_addr = mit + 4 * i + 24;
// let tmp2 = mit->dimensions[i];
let mit_dim_i = _HEAP32[mit_dim_i_addr / 4];
if (mit_dim_i == = 1) {
_HEAP32[mit_dim_i_addr / 4] = it_dims_k;
} else if (mit_dim_i != = it_dims_k) {
let mit_dim_i = HEAP32[mit_dim_i_addr / 4];
if (mit_dim_i == 1) {
HEAP32[mit_dim_i_addr / 4] = it_dims_k;
} else if (mit_dim_i != it_dims_k) {
_set_shape_mismatch_err();
return -1;
}
Expand Down