Skip to content

Fix integer overflow vulnerability in BalanceTrajectory and ComputeSmall #1075

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
mhucka wants to merge 5 commits into
base: master
Choose a base branch
from
+11 −1
Draft

Fix integer overflow vulnerability in BalanceTrajectory and ComputeSmall #1075

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
ad80158
Use size_t or int64_t for trajectory size arithmetic
mhucka May 22, 2026
f598888
Format
mhucka May 22, 2026
991b01a
Change how this is done; just check input value
mhucka May 22, 2026
ec3b024
Check the number of inputs to `Compute()`
mhucka May 22, 2026
c5499e1
Merge branch 'master' into fix-noisy-samples
mhucka May 22, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion tensorflow_quantum/core/ops/noise/tfq_noisy_samples.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -228,7 +228,8 @@ class TfqNoisySamplesOp : public tensorflow::OpKernel {
num_threads, std::vector<long>(output_dim_batch_size, 0));

for (int i = 0; i < output_dim_batch_size; i++) {
int p_reps = (num_samples + num_threads - 1) / num_threads;
uint64_t p_reps =
(static_cast<uint64_t>(num_samples) + num_threads - 1) / num_threads;
Comment thread
mhucka marked this conversation as resolved.
Outdated
offset_prefix_sum[0][i] = rep_offsets[0][i] + p_reps;
for (int j = 1; j < num_threads; j++) {
offset_prefix_sum[j][i] += offset_prefix_sum[j - 1][i];
Expand Down
7 changes: 4 additions & 3 deletions tensorflow_quantum/core/src/util_balance_trajectory.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -75,9 +75,10 @@ void BalanceTrajectory(const int& num_samples, const int& num_threads,

int prev_max_height = -1;
for (size_t j = 0; j < (*thread_offsets)[0].size(); j++) {
int run_ceiling = ((num_samples + num_threads - 1) / num_threads);
int num_lo = num_threads * run_ceiling - num_samples;
int num_hi = num_threads - num_lo;
uint64_t run_ceiling =
((static_cast<uint64_t>(num_samples) + num_threads - 1) / num_threads);
uint64_t num_lo = num_threads * run_ceiling - num_samples;
uint64_t num_hi = num_threads - num_lo;
Comment thread
mhucka marked this conversation as resolved.
Outdated
int cur_max = prev_max_height;
for (int i = 0; i < num_threads; i++) {
if (height[i] == cur_max && num_lo) {
Expand Down
Loading