From b8250c5f0baa4529dd33b1cf2562dd775562283c Mon Sep 17 00:00:00 2001 From: Lucy Qiu Date: Fri, 7 Nov 2025 11:17:42 -0800 Subject: [PATCH] Fix stack buffer overflow in get_view_as_real_copy_out_target_size (#15625) Summary: Check that self.dim() is smaller than kTensorDimensionLimit, otherwise we may write past the end of the out tensor. Reviewed By: JacobSzwejbka Differential Revision: D86356264 --- kernels/portable/cpu/op_view_as_real_copy.cpp | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/kernels/portable/cpu/op_view_as_real_copy.cpp b/kernels/portable/cpu/op_view_as_real_copy.cpp index 4461ecb02f8..fe0ced2f722 100644 --- a/kernels/portable/cpu/op_view_as_real_copy.cpp +++ b/kernels/portable/cpu/op_view_as_real_copy.cpp @@ -41,6 +41,14 @@ Tensor& view_as_real_copy_out( // Get the output shape Tensor::SizesType expected_output_size[kTensorDimensionLimit]; + ET_KERNEL_CHECK_MSG( + ctx, + static_cast(self.dim()) < kTensorDimensionLimit, + InvalidArgument, + out, + "Output size buffer is too small. Expected at least %zu, got %zu", + self.dim() + 1, + kTensorDimensionLimit); get_view_as_real_copy_out_target_size(self, expected_output_size); // Resize for dynamic shape