Overview

High
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactOut of bounds memory access in WebML
DescriptionOut of bounds memory access in WebML
ComponentWebML
Bug ClassOOB
Tracker482875307
Fix commitc74e83f433f5 (external/github.com/google/ruy) +4/-3
CISA KEVNot listed
CreditedGoogle
Disclosed2026-03-10

Changed Functions

FunctionChangeNotes
if
ruy/pack_avx2_fma.cc
modified

Files Changed

  • ruy/mat.h
  • ruy/pack_avx2_fma.cc
From c74e83f433f56aa88465486c5be185369142e61e Mon Sep 17 00:00:00 2001
From: Reilly Grant <[email protected]>
Date: Wed, 25 Feb 2026 00:18:33 +0000
Subject: [PATCH] [M-146] Use std::ptrdiff_t for matrix dimensions and indices.

(Cherry-picked from 8a21714c60bdf0aa95405404e7322e455a34de72.)

PiperOrigin-RevId: 868743667
Bug: 482875307
Change-Id: I9de8e25ff4d22ff99bd63ad1573cfcc8d2aba990
---

diff --git a/ruy/mat.h b/ruy/mat.h
index c2254f9..520d717 100644
--- a/ruy/mat.h
+++ b/ruy/mat.h
@@ -328,7 +328,7 @@
 }
 
 inline std::ptrdiff_t FlatSize(const MatLayout& layout) {
-  const int outerdim =
+  const std::ptrdiff_t outerdim =
       layout.order == Order::kColMajor ? layout.cols : layout.rows;
   return layout.stride * outerdim;
 }
diff --git a/ruy/pack_avx2_fma.cc b/ruy/pack_avx2_fma.cc
index 2564b72..116854b 100644
--- a/ruy/pack_avx2_fma.cc
+++ b/ruy/pack_avx2_fma.cc
@@ -13,6 +13,7 @@
 limitations under the License.
 ==============================================================================*/
 
+#include <cstddef>
 #include <cstdint>
 #include <cstring>
 
@@ -595,9 +596,9 @@
       src_ptr, zerobuf, src_stride, remaining_src_cols, src_rows, packed_ptr,
       trailing_buf);
 
-  const int trailing_rows = src_rows & (kPackRows - 1);
+  const std::ptrdiff_t trailing_rows = src_rows & (kPackRows - 1);
   if (trailing_rows > 0) {
-    const int non_trailing_rows = src_rows & ~(kPackRows - 1);
+    const std::ptrdiff_t non_trailing_rows = src_rows & ~(kPackRows - 1);
     memcpy(packed_ptr + kPackCols * non_trailing_rows, trailing_buf,
            kPackCols * trailing_rows * sizeof(float));
   }
Loading diff…

Original Bug Report

reported by [email protected]

webnn_graph_mojolpm_fuzzer: Segv on unknown address in ruy::MulFrontEndFromTrMulParams

Detailed Report: https://clusterfuzz.com/testcase?key=5384407544168448

Fuzzing Engine: libFuzzer Fuzz Target: webnn_graph_mojolpm_fuzzer Job Type: mac_libfuzzer_chrome_asan Platform Id: mac

Crash Type: Segv on unknown address Crash Address: Crash State: ruy::MulFrontEndFromTrMulParams void ruy::MulFrontEnd< tflite::cpu_backend_gemm::detail::GemmImplUsingRuy<float, float, float, float,

Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=mac_libfuzzer_chrome_asan&range=1468407:1468456

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5384407544168448

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for instructions on reproducing this bug locally.

View on issue tracker