Upload README.md with huggingface_hub
Browse files
README.md
ADDED
|
@@ -0,0 +1,21 @@
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 1 |
+
# PoC: compute_numel() Integer Overflow on MSVC (Windows) Builds
|
| 2 |
+
|
| 3 |
+
**Vulnerability:** `c10/core/TensorImpl.h:2596-2604` — `compute_numel()` uses the unsafe `multiply_integers()` path on MSVC builds because `C10_HAS_BUILTIN_OVERFLOW()` is unconditionally 0 on MSVC (`safe_numerics.h:9-10`). This disables overflow detection for all Windows PyTorch users.
|
| 4 |
+
|
| 5 |
+
## Files
|
| 6 |
+
|
| 7 |
+
- `poc_numel_msvc_overflow.py` — Full PoC (crafted model + UBSan-confirmed overflow)
|
| 8 |
+
- `test_msvc_overflow.cpp` — Standalone C++ UBSan test
|
| 9 |
+
- `numel_overflow_model.pt` — Crafted model with overflow dimensions
|
| 10 |
+
|
| 11 |
+
## Quick Start
|
| 12 |
+
|
| 13 |
+
```bash
|
| 14 |
+
pip install torch
|
| 15 |
+
python poc_numel_msvc_overflow.py
|
| 16 |
+
```
|
| 17 |
+
|
| 18 |
+
## Expected Output
|
| 19 |
+
|
| 20 |
+
- GCC/Clang: `safe_compute_numel()` catches overflow (RuntimeError)
|
| 21 |
+
- MSVC path: `multiply_integers()` silently overflows (UBSan confirmed)
|