llvm
/
torch-mlir
mirror of https://github.com/llvm/torch-mlir
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

TorchOnnxToTorch: Fix stack-use-after-free (#3480) 

We used to move the SmallVector into an ArrayRef and then the
SmallVector left the scope.

Found by asan.
pull/3525/head
Matthias Gehre 2024-07-08 09:20:09 +02:00 committed by GitHub
parent 3225f20ab1
commit 6ea6a6c2fe
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 4 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
lib/Conversion/TorchOnnxToTorch/DefaultDomainGtoP.cpp
View File

@ -1569,11 +1569,12 @@ void mlir::torch::onnx_c::populateDefaultDomainGtoP(
auto transpose = [&](Value m) -> Value { auto transpose = [&](Value m) -> Value {
auto tty = cast<Torch::ValueTensorType>(m.getType()); auto tty = cast<Torch::ValueTensorType>(m.getType());
auto shape = tty.getOptionalSizes(); std::optional<ArrayRef<int64_t>> shape = tty.getOptionalSizes();
llvm::SmallVector<int64_t> newShape;
if (shape.has_value()) { if (shape.has_value()) {
llvm::SmallVector<int64_t> newShape(shape.value()); newShape.append(shape.value().begin(), shape.value().end());
std::reverse(newShape.begin(), newShape.end()); std::reverse(newShape.begin(), newShape.end());
shape = std::move(newShape); shape = newShape;
} }
auto oty = Torch::ValueTensorType::get(tty.getContext(), shape, auto oty = Torch::ValueTensorType::get(tty.getContext(), shape,
tty.getOptionalDtype()); tty.getOptionalDtype());