Skip to content

Commit

Permalink
Apply the patch from Reference-LAPACK/lapack#625 (ref JuliaLang/julia…
Browse files Browse the repository at this point in the history
…#42415)
  • Loading branch information
DilumAluthge committed Oct 7, 2021
1 parent 27fe6fe commit 571f0cc
Show file tree
Hide file tree
Showing 3 changed files with 234 additions and 0 deletions.
Original file line number Diff line number Diff line change
@@ -0,0 +1,78 @@
From 0631b6beaed60ba118b0b027c0f8d35397bf5df0 Mon Sep 17 00:00:00 2001
From: Keno Fischer <[email protected]>
Date: Thu, 30 Sep 2021 03:51:23 -0400
Subject: [PATCH] Fix out of bounds read in slarrv

This was originally reported as https://github.com/JuliaLang/julia/issues/42415.
I've tracked this down to an our of bounds read on the following line:

https://github.com/Reference-LAPACK/lapack/blob/44ecb6a5ff821b1cbb39f8cc2166cb098e060b4d/SRC/slarrv.f#L423

In the crashing example, `M` is `0`, causing `slarrv` to read uninitialized
memory from the work array. I believe the `0` for `M` is correct and indeed,
the documentation above supports that `M` may be zero:

https://github.com/Reference-LAPACK/lapack/blob/44ecb6a5ff821b1cbb39f8cc2166cb098e060b4d/SRC/slarrv.f#L113-L116

I believe it may be sufficient to early-out this function as suggested
in this PR. However, I have limited context for the full routine here,
so I would appreciate a sanity check.
---
SRC/clarrv.f | 2 +-
SRC/dlarrv.f | 2 +-
SRC/slarrv.f | 2 +-
SRC/zlarrv.f | 2 +-
4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/SRC/clarrv.f b/SRC/clarrv.f
index 1f09e4da6..42f710757 100644
--- a/SRC/clarrv.f
+++ b/SRC/clarrv.f
@@ -348,7 +348,7 @@ SUBROUTINE CLARRV( N, VL, VU, D, L, PIVMIN,
*
* Quick return if possible
*
- IF( N.LE.0 ) THEN
+ IF( (N.LE.0).OR.(M.LE.0) ) THEN
RETURN
END IF
*
diff --git a/SRC/dlarrv.f b/SRC/dlarrv.f
index b036c1e66..299430361 100644
--- a/SRC/dlarrv.f
+++ b/SRC/dlarrv.f
@@ -350,7 +350,7 @@ SUBROUTINE DLARRV( N, VL, VU, D, L, PIVMIN,
*
* Quick return if possible
*
- IF( N.LE.0 ) THEN
+ IF( (N.LE.0).OR.(M.LE.0) ) THEN
RETURN
END IF
*
diff --git a/SRC/slarrv.f b/SRC/slarrv.f
index 9d72b339a..95f94fd1b 100644
--- a/SRC/slarrv.f
+++ b/SRC/slarrv.f
@@ -350,7 +350,7 @@ SUBROUTINE SLARRV( N, VL, VU, D, L, PIVMIN,
*
* Quick return if possible
*
- IF( N.LE.0 ) THEN
+ IF( (N.LE.0).OR.(M.LE.0) ) THEN
RETURN
END IF
*
diff --git a/SRC/zlarrv.f b/SRC/zlarrv.f
index 51ec558f5..e4be63e0d 100644
--- a/SRC/zlarrv.f
+++ b/SRC/zlarrv.f
@@ -348,7 +348,7 @@ SUBROUTINE ZLARRV( N, VL, VU, D, L, PIVMIN,
*
* Quick return if possible
*
- IF( N.LE.0 ) THEN
+ IF( (N.LE.0).OR.(M.LE.0) ) THEN
RETURN
END IF
*
Original file line number Diff line number Diff line change
@@ -0,0 +1,78 @@
From 0631b6beaed60ba118b0b027c0f8d35397bf5df0 Mon Sep 17 00:00:00 2001
From: Keno Fischer <[email protected]>
Date: Thu, 30 Sep 2021 03:51:23 -0400
Subject: [PATCH] Fix out of bounds read in slarrv

This was originally reported as https://github.com/JuliaLang/julia/issues/42415.
I've tracked this down to an our of bounds read on the following line:

https://github.com/Reference-LAPACK/lapack/blob/44ecb6a5ff821b1cbb39f8cc2166cb098e060b4d/SRC/slarrv.f#L423

In the crashing example, `M` is `0`, causing `slarrv` to read uninitialized
memory from the work array. I believe the `0` for `M` is correct and indeed,
the documentation above supports that `M` may be zero:

https://github.com/Reference-LAPACK/lapack/blob/44ecb6a5ff821b1cbb39f8cc2166cb098e060b4d/SRC/slarrv.f#L113-L116

I believe it may be sufficient to early-out this function as suggested
in this PR. However, I have limited context for the full routine here,
so I would appreciate a sanity check.
---
SRC/clarrv.f | 2 +-
SRC/dlarrv.f | 2 +-
SRC/slarrv.f | 2 +-
SRC/zlarrv.f | 2 +-
4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/SRC/clarrv.f b/SRC/clarrv.f
index 1f09e4da6..42f710757 100644
--- a/SRC/clarrv.f
+++ b/SRC/clarrv.f
@@ -348,7 +348,7 @@ SUBROUTINE CLARRV( N, VL, VU, D, L, PIVMIN,
*
* Quick return if possible
*
- IF( N.LE.0 ) THEN
+ IF( (N.LE.0).OR.(M.LE.0) ) THEN
RETURN
END IF
*
diff --git a/SRC/dlarrv.f b/SRC/dlarrv.f
index b036c1e66..299430361 100644
--- a/SRC/dlarrv.f
+++ b/SRC/dlarrv.f
@@ -350,7 +350,7 @@ SUBROUTINE DLARRV( N, VL, VU, D, L, PIVMIN,
*
* Quick return if possible
*
- IF( N.LE.0 ) THEN
+ IF( (N.LE.0).OR.(M.LE.0) ) THEN
RETURN
END IF
*
diff --git a/SRC/slarrv.f b/SRC/slarrv.f
index 9d72b339a..95f94fd1b 100644
--- a/SRC/slarrv.f
+++ b/SRC/slarrv.f
@@ -350,7 +350,7 @@ SUBROUTINE SLARRV( N, VL, VU, D, L, PIVMIN,
*
* Quick return if possible
*
- IF( N.LE.0 ) THEN
+ IF( (N.LE.0).OR.(M.LE.0) ) THEN
RETURN
END IF
*
diff --git a/SRC/zlarrv.f b/SRC/zlarrv.f
index 51ec558f5..e4be63e0d 100644
--- a/SRC/zlarrv.f
+++ b/SRC/zlarrv.f
@@ -348,7 +348,7 @@ SUBROUTINE ZLARRV( N, VL, VU, D, L, PIVMIN,
*
* Quick return if possible
*
- IF( N.LE.0 ) THEN
+ IF( (N.LE.0).OR.(M.LE.0) ) THEN
RETURN
END IF
*
Original file line number Diff line number Diff line change
@@ -0,0 +1,78 @@
From 0631b6beaed60ba118b0b027c0f8d35397bf5df0 Mon Sep 17 00:00:00 2001
From: Keno Fischer <[email protected]>
Date: Thu, 30 Sep 2021 03:51:23 -0400
Subject: [PATCH] Fix out of bounds read in slarrv

This was originally reported as https://github.com/JuliaLang/julia/issues/42415.
I've tracked this down to an our of bounds read on the following line:

https://github.com/Reference-LAPACK/lapack/blob/44ecb6a5ff821b1cbb39f8cc2166cb098e060b4d/SRC/slarrv.f#L423

In the crashing example, `M` is `0`, causing `slarrv` to read uninitialized
memory from the work array. I believe the `0` for `M` is correct and indeed,
the documentation above supports that `M` may be zero:

https://github.com/Reference-LAPACK/lapack/blob/44ecb6a5ff821b1cbb39f8cc2166cb098e060b4d/SRC/slarrv.f#L113-L116

I believe it may be sufficient to early-out this function as suggested
in this PR. However, I have limited context for the full routine here,
so I would appreciate a sanity check.
---
SRC/clarrv.f | 2 +-
SRC/dlarrv.f | 2 +-
SRC/slarrv.f | 2 +-
SRC/zlarrv.f | 2 +-
4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/SRC/clarrv.f b/SRC/clarrv.f
index 1f09e4da6..42f710757 100644
--- a/SRC/clarrv.f
+++ b/SRC/clarrv.f
@@ -348,7 +348,7 @@ SUBROUTINE CLARRV( N, VL, VU, D, L, PIVMIN,
*
* Quick return if possible
*
- IF( N.LE.0 ) THEN
+ IF( (N.LE.0).OR.(M.LE.0) ) THEN
RETURN
END IF
*
diff --git a/SRC/dlarrv.f b/SRC/dlarrv.f
index b036c1e66..299430361 100644
--- a/SRC/dlarrv.f
+++ b/SRC/dlarrv.f
@@ -350,7 +350,7 @@ SUBROUTINE DLARRV( N, VL, VU, D, L, PIVMIN,
*
* Quick return if possible
*
- IF( N.LE.0 ) THEN
+ IF( (N.LE.0).OR.(M.LE.0) ) THEN
RETURN
END IF
*
diff --git a/SRC/slarrv.f b/SRC/slarrv.f
index 9d72b339a..95f94fd1b 100644
--- a/SRC/slarrv.f
+++ b/SRC/slarrv.f
@@ -350,7 +350,7 @@ SUBROUTINE SLARRV( N, VL, VU, D, L, PIVMIN,
*
* Quick return if possible
*
- IF( N.LE.0 ) THEN
+ IF( (N.LE.0).OR.(M.LE.0) ) THEN
RETURN
END IF
*
diff --git a/SRC/zlarrv.f b/SRC/zlarrv.f
index 51ec558f5..e4be63e0d 100644
--- a/SRC/zlarrv.f
+++ b/SRC/zlarrv.f
@@ -348,7 +348,7 @@ SUBROUTINE ZLARRV( N, VL, VU, D, L, PIVMIN,
*
* Quick return if possible
*
- IF( N.LE.0 ) THEN
+ IF( (N.LE.0).OR.(M.LE.0) ) THEN
RETURN
END IF
*

0 comments on commit 571f0cc

Please sign in to comment.