From 99d184853d9c01bb0417724908fdcf0781533a1f Mon Sep 17 00:00:00 2001 From: "The gemma.cpp Authors" Date: Tue, 11 Aug 2026 23:04:15 -0700 Subject: [PATCH] Fix buffer overflow in compression int_test. `IntCodec::DecompressAndZeroPad` zero-pads the output buffer up to the nearest vector lane boundary (`hwy::RoundUpTo(num, Lanes(d))`). In `TestUnalignedOffset`, allocating only `num_decompressed` elements for `dec2` resulted in out-of-bounds writes when `num_decompressed` was smaller than the vector lane count, causing a heap-buffer-overflow under HWASAN. Allocate `RoundUpTo(num_decompressed, hn::Lanes(d))` elements for `dec2` in `TestUnalignedOffset`. Additionally, pass the buffer size in bytes (`num * sizeof(T)`) to `MaybeCheckInitialized` in `TestSmallDequantize`. PiperOrigin-RevId: 963226784 --- compression/int_test.cc | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/compression/int_test.cc b/compression/int_test.cc index f4273840..c540200e 100644 --- a/compression/int_test.cc +++ b/compression/int_test.cc @@ -243,7 +243,8 @@ struct TestUnalignedOffset { auto dec1 = hwy::AllocateAligned(total); auto i8_stream = hwy::AllocateAligned(I8Stream::PackedEnd(total)); - auto dec2 = hwy::AllocateAligned(num_decompressed); + auto dec2 = hwy::AllocateAligned( + hwy::RoundUpTo(num_decompressed, hn::Lanes(d))); HWY_ASSERT(in && dec1 && dec2 && i8_stream); const auto int_span = MakeSpan(i8_stream.get(), total); @@ -408,7 +409,7 @@ struct TestSmallDequantize { IntCodec::DecompressAndZeroPad(d, MakeConst(int_span), offset, actual_dec.get(), num); - MaybeCheckInitialized(actual_dec.get(), num); + MaybeCheckInitialized(actual_dec.get(), num * sizeof(T)); // Check that all sentinels were overwritten. for (size_t i = 0; i < num; ++i) {