0xiviel commited on
Commit
df24f6d
·
verified ·
1 Parent(s): 773e4c8

Upload README.md with huggingface_hub

Browse files
Files changed (1) hide show
  1. README.md +21 -0
README.md ADDED
@@ -0,0 +1,21 @@
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
+ # PoC: compute_numel() Integer Overflow on MSVC (Windows) Builds
2
+
3
+ **Vulnerability:** `c10/core/TensorImpl.h:2596-2604` — `compute_numel()` uses the unsafe `multiply_integers()` path on MSVC builds because `C10_HAS_BUILTIN_OVERFLOW()` is unconditionally 0 on MSVC (`safe_numerics.h:9-10`). This disables overflow detection for all Windows PyTorch users.
4
+
5
+ ## Files
6
+
7
+ - `poc_numel_msvc_overflow.py` — Full PoC (crafted model + UBSan-confirmed overflow)
8
+ - `test_msvc_overflow.cpp` — Standalone C++ UBSan test
9
+ - `numel_overflow_model.pt` — Crafted model with overflow dimensions
10
+
11
+ ## Quick Start
12
+
13
+ ```bash
14
+ pip install torch
15
+ python poc_numel_msvc_overflow.py
16
+ ```
17
+
18
+ ## Expected Output
19
+
20
+ - GCC/Clang: `safe_compute_numel()` catches overflow (RuntimeError)
21
+ - MSVC path: `multiply_integers()` silently overflows (UBSan confirmed)