Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

pddbtrsv potential buffer overrun #115

Open
TLCFEM opened this issue Mar 7, 2025 · 0 comments
Open

pddbtrsv potential buffer overrun #115

TLCFEM opened this issue Mar 7, 2025 · 0 comments

Comments

@TLCFEM
Copy link

TLCFEM commented Mar 7, 2025

The LWORK size is given here.

scalapack/SRC/pddbtrsv.f

Lines 128 to 132 in a23c2cd

* LWORK (local input or global input) INTEGER
* Size of user-input workspace WORK.
* If LWORK is too small, the minimal acceptable size will be
* returned in WORK(1) and an error code is returned. LWORK>=
* (max(bwl,bwu)*NRHS)

But in the following call, the size required is larger.

scalapack/SRC/pddbtrsv.f

Lines 1499 to 1500 in a23c2cd

CALL DLAMOV( 'N', BWU, NRHS, B( PART_OFFSET+ODD_SIZE+1 ),
$ LLDB, WORK( 1+MAX_BW-BWU ), MAX_BW+BWL )

Assuming the trailing MAX_BW + BWL - BWU elements are not accessed, this DLAMOV call requires the following size of WORK:

MAX_BW - BWU + ( MAX_BW + BWL ) * NRHS - MAX_BW - BWL + BWU
= MAX_BW * NRHS + BWL * ( NRHS - 1 )

The current implementation results in a buffer overrun.
A simple case can be reproduced using the following setting.

RANK = 2, N = 42, NRHS = 13, KL = 15, KU = 12, BLOCK = 30, LOCr(N) = 0
RANK = 0, N = 42, NRHS = 13, KL = 15, KU = 12, BLOCK = 30, LOCr(N) = 30
RANK = 1, N = 42, NRHS = 13, KL = 15, KU = 12, BLOCK = 30, LOCr(N) = 12

Maybe the minimum size shall be revised.
For simplicity, MAX_BW * ( 2 * NRHS - 1 ) or MAX_BW * 2 * NRHS.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant