From dee5a10e4932fdd0f302c96c8759d656db586652 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?F=C3=A9lix=20Richart?= Date: Thu, 22 Jun 2023 14:23:44 +0200 Subject: [PATCH 1/4] Prevent ndarray from overflowing size_t --- code/ndarray.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/code/ndarray.c b/code/ndarray.c index 88186759..0741edc4 100644 --- a/code/ndarray.c +++ b/code/ndarray.c @@ -622,6 +622,10 @@ ndarray_obj_t *ndarray_new_ndarray(uint8_t ndim, size_t *shape, int32_t *strides ndarray->len = multiply_size(ndarray->len, shape[i-1]); } + if (SIZE_MAX / ndarray->itemsize <= ndarray->len) { + mp_raise_ValueError(translate("ndarray length overflows")); + } + // if the length is 0, still allocate a single item, so that contractions can be handled size_t len = multiply_size(ndarray->itemsize, MAX(1, ndarray->len)); uint8_t *array = m_new0(byte, len); From b3f283aa4ca8d3ac626b4475765a0a6b8922bf99 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?F=C3=A9lix=20Richart?= Date: Thu, 22 Jun 2023 14:25:06 +0200 Subject: [PATCH 2/4] Use size_t for polyval array len --- code/numpy/poly.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/code/numpy/poly.c b/code/numpy/poly.c index 97ee5c75..62eb1688 100644 --- a/code/numpy/poly.c +++ b/code/numpy/poly.c @@ -161,7 +161,7 @@ mp_obj_t poly_polyval(mp_obj_t o_p, mp_obj_t o_x) { } #endif // p had better be a one-dimensional standard iterable - uint8_t plen = mp_obj_get_int(mp_obj_len_maybe(o_p)); + size_t plen = (size_t)mp_obj_get_int(mp_obj_len_maybe(o_p)); mp_float_t *p = m_new(mp_float_t, plen); mp_obj_iter_buf_t p_buf; mp_obj_t p_item, p_iterable = mp_getiter(o_p, &p_buf); From 4dbdcd89b533985817ecaa33edc380995d6de698 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?F=C3=A9lix=20Richart?= Date: Thu, 22 Jun 2023 14:25:42 +0200 Subject: [PATCH 3/4] Fix infinite arange --- code/numpy/create.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/code/numpy/create.c b/code/numpy/create.c index 0f5bce00..6c1c75fd 100644 --- a/code/numpy/create.c +++ b/code/numpy/create.c @@ -158,7 +158,7 @@ mp_obj_t create_arange(size_t n_args, const mp_obj_t *pos_args, mp_map_t *kw_arg mp_raise_msg(&mp_type_ZeroDivisionError, MP_ERROR_TEXT("divide by zero")); } - if(isnan(start) || isnan(stop) || isnan(step)) { + if(!isfinite(start) || !isfinite(stop) || !isfinite(step)) { mp_raise_ValueError(translate("arange: cannot compute length")); } From 0aee7c88b64e9906c0ece1f238f44879b38f0832 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?F=C3=A9lix=20Richart?= Date: Thu, 22 Jun 2023 14:27:32 +0200 Subject: [PATCH 4/4] 6.3.1 version --- code/ulab.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/code/ulab.c b/code/ulab.c index 21d72b80..ff3b5831 100644 --- a/code/ulab.c +++ b/code/ulab.c @@ -33,7 +33,7 @@ #include "user/user.h" #include "utils/utils.h" -#define ULAB_VERSION 6.3.0 +#define ULAB_VERSION 6.3.1 #define xstr(s) str(s) #define str(s) #s