Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix possible itemsize overflows in usm_ndarray from-pointer constructors #2003

Merged
merged 2 commits into from
Feb 21, 2025
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 8 additions & 4 deletions dpctl/tensor/_usmarray.pyx
Original file line number Diff line number Diff line change
Expand Up @@ -1777,8 +1777,10 @@ cdef api object UsmNDArray_MakeSimpleFromPtr(
Returns:
Created usm_ndarray instance
"""
cdef size_t itemsize = type_bytesize(typenum)
cdef size_t nbytes = itemsize * nelems
cdef int itemsize = type_bytesize(typenum)
if (itemsize < 1):
raise ValueError("dtype with typenum=" + str(typenum) + " is not supported.")
cdef size_t nbytes = (<size_t> itemsize) * nelems
cdef c_dpmem._Memory mobj = c_dpmem._Memory.create_from_usm_pointer_size_qref(
ptr, nbytes, QRef, memory_owner=owner
)
Expand Down Expand Up @@ -1817,7 +1819,7 @@ cdef api object UsmNDArray_MakeFromPtr(
Returns:
Created usm_ndarray instance
"""
cdef size_t itemsize = type_bytesize(typenum)
cdef int itemsize = type_bytesize(typenum)
cdef int err = 0
cdef size_t nelems = 1
cdef Py_ssize_t min_disp = 0
Expand All @@ -1830,6 +1832,8 @@ cdef api object UsmNDArray_MakeFromPtr(
cdef object obj_shape
cdef object obj_strides

if (itemsize < 1):
raise ValueError("dtype with typenum=" + str(typenum) + " is not supported.")
if (nd < 0):
raise ValueError("Dimensionality must be non-negative")
if (ptr is NULL or QRef is NULL):
Expand Down Expand Up @@ -1881,7 +1885,7 @@ cdef api object UsmNDArray_MakeFromPtr(
raise ValueError(
"Given shape, strides and offset reference out-of-bound memory"
)
nbytes = itemsize * (offset + max_disp + 1)
nbytes = (<size_t> itemsize) * (offset + max_disp + 1)
mobj = c_dpmem._Memory.create_from_usm_pointer_size_qref(
ptr, nbytes, QRef, memory_owner=owner
)
Expand Down
69 changes: 69 additions & 0 deletions dpctl/tests/test_usm_ndarray_ctor.py
Original file line number Diff line number Diff line change
Expand Up @@ -963,6 +963,75 @@ def test_pyx_capi_make_general():
assert zd_arr._pointer == mat._pointer


def test_pyx_capi_make_fns_invalid_typenum():
q = get_queue_or_skip()
usm_ndarray = dpt.empty(tuple(), dtype="i4", sycl_queue=q)

make_simple_from_ptr = _pyx_capi_fnptr_to_callable(
usm_ndarray,
"UsmNDArray_MakeSimpleFromPtr",
b"PyObject *(size_t, int, DPCTLSyclUSMRef, "
b"DPCTLSyclQueueRef, PyObject *)",
fn_restype=ctypes.py_object,
fn_argtypes=(
ctypes.c_size_t,
ctypes.c_int,
ctypes.c_void_p,
ctypes.c_void_p,
ctypes.py_object,
),
)

nelems = 10
dtype = dpt.int64
arr = dpt.arange(nelems, dtype=dtype, sycl_queue=q)

with pytest.raises(ValueError):
make_simple_from_ptr(
ctypes.c_size_t(nelems),
-1,
arr._pointer,
arr.sycl_queue.addressof_ref(),
arr,
)

make_from_ptr = _pyx_capi_fnptr_to_callable(
usm_ndarray,
"UsmNDArray_MakeFromPtr",
b"PyObject *(int, Py_ssize_t const *, int, Py_ssize_t const *, "
b"DPCTLSyclUSMRef, DPCTLSyclQueueRef, Py_ssize_t, PyObject *)",
fn_restype=ctypes.py_object,
fn_argtypes=(
ctypes.c_int,
ctypes.POINTER(ctypes.c_ssize_t),
ctypes.c_int,
ctypes.POINTER(ctypes.c_ssize_t),
ctypes.c_void_p,
ctypes.c_void_p,
ctypes.c_ssize_t,
ctypes.py_object,
),
)
c_shape = (ctypes.c_ssize_t * 1)(
nelems,
)
c_strides = (ctypes.c_ssize_t * 1)(
1,
)
with pytest.raises(ValueError):
make_from_ptr(
ctypes.c_int(1),
c_shape,
-1,
c_strides,
arr._pointer,
arr.sycl_queue.addressof_ref(),
ctypes.c_ssize_t(0),
arr,
)
del arr


def _pyx_capi_int(X, pyx_capi_name, caps_name=b"int", val_restype=ctypes.c_int):
import sys

Expand Down
Loading