bugGNU Octave - Bugs: bug #63466, Possible invalid memory access in...


bug #63466: Possible invalid memory access in NDArray::dim3()

Submitter:  None
Submitted:  Sun 04 Dec 2022 01:14:29 PM UTC
Category:  Libraries Severity:  3 - Normal
Priority:  5 - Normal Item Group:  Unexpected Error or Warning
Status:  Fixed Assigned to:  None
Originator Name:  Reinhard Originator Email:  -email is unavailable-
Open/Closed:  * Closed Release:  * 7.3.0
Operating System:  * GNU/Linux Fixed Release:  8.1.0 (current stable)
Planned Release:  8.1.0 (current stable)
* Mandatory Fields

Add a New Comment (Rich Markup)

Comment Type & Canned Response:


Sat 10 Dec 2022 01:23:34 AM UTC, comment #2: 

I fixed this on the stable branch here: http://hg.savannah.gnu.org/hgweb/octave/rev/33ce26ffc42b.

Closing report.

Rik <rik5>
Project Administrator
Mon 05 Dec 2022 12:21:32 AM UTC, comment #1: 

I agree that this should be made safe.  In the Octave interpreter, the function size() is defined in data.cc and it specifically does a test on the number of dimensions before returning either the true dimension of the array or 1.

          m(i) = nd <= ndims ? dimensions (nd-1) : 1;

Rik <rik5>
Project Administrator
Sun 04 Dec 2022 01:14:29 PM UTC, original submission:  

It seems that a call to NDArray::dim3() is not a safe operation in C++ code. For example if you have code like this,

void func(NDArray& x)
  octave_idx_type n = x.dim3();

the value of n might be undefined if the dim_vector has less then three dimensions. So, the correct code should be:

void func(NDArray& x)
  octave_idx_type n = x.ndims() >= 3 ? x.dim3() : 1;

But why do we have a function like NDArray::dim3(), if it is not safe to call without checking ndims? For example, code like this would be more concise.

void func(NDArray& x)
  octave_idx_type n = x.ndims() > 2 ? x.dims()(2) : 1;

In contradiction to that, NDArray::dim1() and NDArray::dim2() are always valid because dim_vector will allocate space for at least two dimensions. So, it makes sense to have those functions defined.
I would suggest either to make NDArray::dim3() safe or to remove it.



(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:

No files currently attached


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -email is unavailable- added by rik5 (Posted a comment)
  • -email is unavailable- added by None (Submitted the item)

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only project members can vote.





    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2022-12-10 rik5 StatusNone Fixed
        Open/ClosedOpen Closed
        Fixed ReleaseNone 8.1.0 (current stable)
        Planned ReleaseNone 8.1.0 (current stable)

    Back to the top

    Powered by Savane 3.9