The GitHub Actions job "CI" on tvm-ffi.git/tvm-ffi-harden-serialization has failed. Run started by GitHub user tqchen (triggered by tqchen).
Head commit for run: 31928dbc7710b9b19fe0bef9785057e1bf0bdfad / tqchen <[email protected]> [Extra] Guard FromJSONGraph deserialization against malformed input The object-graph deserializer (FromJSONGraph) previously trusted several values taken directly from the input JSON. Malformed or truncated input could lead to an out-of-bounds read or deep C++ recursion instead of a clean error. This adds input validation so such cases throw an ffi::Error rather than reading out of bounds. Hardening in src/ffi/extra/serialization.cc: - Validate every node index (root_index and all child/key/value/field references) against the nodes array before indexing into the decoded_nodes_ std::vector, so an out-of-range or negative index throws instead of reading past the vector. - Add a recursion-depth guard so a deeply nested graph or a long chain of node references throws rather than recursing without bound; a self-referential node also terminates by throwing. - Require Device data to be exactly [device_type, device_id]. - Require Map/Dict data to have an even number of [key, value] entries so the inner loop cannot read one element past the end. All previously-trusted indices, sizes, kinds and keys now throw an ffi::Error (ValueError / TypeError / KeyError / IndexError) before any out-of-bounds access. Type-key, missing-key, and wrong-value-type cases were already routed through checked accessors and continue to throw. Tests: - tests/cpp/extra/test_serialization.cc: a battery of crafted malformed graphs (out-of-range / negative indices, odd-length map data, wrong device arity, unknown type keys, missing keys, wrong value types, non-object nodes, truncated JSON, deeply nested input, self-cycle), each asserted to throw. The C++ test target builds with AddressSanitizer; the full suite passes clean. - tests/python/test_serialization.py: the same cases at the Python boundary, each asserted to raise. Report URL: https://github.com/apache/tvm-ffi/actions/runs/27284799424 With regards, GitHub Actions via GitBox --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
