Skip to content

BUG: fix CPU feature env diagnostic buffer overruns (#31905) - #31953

Merged
charris merged 1 commit into
numpy:maintenance/2.5.xfrom
charris:backport-31905
Jul 10, 2026
Merged

BUG: fix CPU feature env diagnostic buffer overruns (#31905)#31953
charris merged 1 commit into
numpy:maintenance/2.5.xfrom
charris:backport-31905

Conversation

@charris

@charris charris commented Jul 10, 2026

Copy link
Copy Markdown
Member

Backport of #31905.

PR summary

This is a follow up to gh-30877.

I've had on the back on my mind to verify and check some other issues I saw in the file and finally managed to get to it.

The original PR fixed a buffer overrun in CPU baseline validation. This PR fixes two similar issues in npy__cpu_check_env.

The two issues fixed:

  • nonexistent features: an accepted maximum-length environment variable value could write the terminating NUL one byte past the nexist stack buffer
  • unsupported dispatched features: repeated unsupported feature names could overflow the notsupp diagnostic buffer, which was sized from NPY_WITH_CPU_DISPATCH rather than from the accepted environment variable length.

Both fixes avoid the trailing-space-and-trim pattern when building the diagnostic strings.

Noting though that the fix for the notsupp buffer increases stack usage in npy__cpu_check_env because the buffer is now bounded by NPY__MAX_VAR_LEN instead of sizeof(NPY_WITH_CPU_DISPATCH) + 1. On my x86_64 laptop, -fstack-usage reports the function growing from 2224 bytes to 3184 bytes, a 960 bytes increase. The function is non-recursive and only runs while parsing CPU feature environment variables during import, however if the size icrease is deemed unacceptable I can change the approach to something like heap allocation, it will require more code changes though.

These tests are mainly sanitizer regressions, in non-sanitized builds, the previous out-of-bounds writes might not crash.

AI Disclosure

I used codex with the gpt 5.5 model. Guided to create the tests, (hence the tests are AI generated) and to review the C code changes, also to verify any incompatibilities (where it verified the stack increase) and to create small reproducers with the same logic for me to actually verify the issues exist.

@charris charris added this to the 2.5.2 release milestone Jul 10, 2026
@charris charris added 00 - Bug 08 - Backport Used to tag backport PRs labels Jul 10, 2026
@charris
charris merged commit f321735 into numpy:maintenance/2.5.x Jul 10, 2026
85 checks passed
@charris
charris deleted the backport-31905 branch July 10, 2026 23:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

00 - Bug 08 - Backport Used to tag backport PRs

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants