CVE-2026-3920
Overview
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifruy/pack_avx2_fma.cc |
modified |
Files Changed
ruy/mat.hruy/pack_avx2_fma.cc
Patch
From c74e83f433f56aa88465486c5be185369142e61e Mon Sep 17 00:00:00 2001 From: Reilly Grant <[email protected]> Date: Wed, 25 Feb 2026 00:18:33 +0000 Subject: [PATCH] [M-146] Use std::ptrdiff_t for matrix dimensions and indices. (Cherry-picked from 8a21714c60bdf0aa95405404e7322e455a34de72.) PiperOrigin-RevId: 868743667 Bug: 482875307 Change-Id: I9de8e25ff4d22ff99bd63ad1573cfcc8d2aba990 --- diff --git a/ruy/mat.h b/ruy/mat.h index c2254f9..520d717 100644 --- a/ruy/mat.h +++ b/ruy/mat.h @@ -328,7 +328,7 @@ } inline std::ptrdiff_t FlatSize(const MatLayout& layout) { - const int outerdim = + const std::ptrdiff_t outerdim = layout.order == Order::kColMajor ? layout.cols : layout.rows; return layout.stride * outerdim; } diff --git a/ruy/pack_avx2_fma.cc b/ruy/pack_avx2_fma.cc index 2564b72..116854b 100644 --- a/ruy/pack_avx2_fma.cc +++ b/ruy/pack_avx2_fma.cc @@ -13,6 +13,7 @@ limitations under the License. ==============================================================================*/ +#include <cstddef> #include <cstdint> #include <cstring> @@ -595,9 +596,9 @@ src_ptr, zerobuf, src_stride, remaining_src_cols, src_rows, packed_ptr, trailing_buf); - const int trailing_rows = src_rows & (kPackRows - 1); + const std::ptrdiff_t trailing_rows = src_rows & (kPackRows - 1); if (trailing_rows > 0) { - const int non_trailing_rows = src_rows & ~(kPackRows - 1); + const std::ptrdiff_t non_trailing_rows = src_rows & ~(kPackRows - 1); memcpy(packed_ptr + kPackCols * non_trailing_rows, trailing_buf, kPackCols * trailing_rows * sizeof(float)); }
Original Bug Report
webnn_graph_mojolpm_fuzzer: Segv on unknown address in ruy::MulFrontEndFromTrMulParams
Detailed Report: https://clusterfuzz.com/testcase?key=5384407544168448
Fuzzing Engine: libFuzzer Fuzz Target: webnn_graph_mojolpm_fuzzer Job Type: mac_libfuzzer_chrome_asan Platform Id: mac
Crash Type: Segv on unknown address Crash Address: Crash State: ruy::MulFrontEndFromTrMulParams void ruy::MulFrontEnd< tflite::cpu_backend_gemm::detail::GemmImplUsingRuy<float, float, float, float,
Sanitizer: address (ASAN)
Regressed: https://clusterfuzz.com/revisions?job=mac_libfuzzer_chrome_asan&range=1468407:1468456
Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5384407544168448
Issue filed automatically.
See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for instructions on reproducing this bug locally.