Skip to content

pddbtrsv potential buffer overrun #115

@TLCFEM

Description

@TLCFEM

The LWORK size is given here.

scalapack/SRC/pddbtrsv.f

Lines 128 to 132 in a23c2cd

* LWORK (local input or global input) INTEGER
* Size of user-input workspace WORK.
* If LWORK is too small, the minimal acceptable size will be
* returned in WORK(1) and an error code is returned. LWORK>=
* (max(bwl,bwu)*NRHS)

But in the following call, the size required is larger.

scalapack/SRC/pddbtrsv.f

Lines 1499 to 1500 in a23c2cd

CALL DLAMOV( 'N', BWU, NRHS, B( PART_OFFSET+ODD_SIZE+1 ),
$ LLDB, WORK( 1+MAX_BW-BWU ), MAX_BW+BWL )

Assuming the trailing MAX_BW + BWL - BWU elements are not accessed, this DLAMOV call requires the following size of WORK:

MAX_BW - BWU + ( MAX_BW + BWL ) * NRHS - MAX_BW - BWL + BWU
= MAX_BW * NRHS + BWL * ( NRHS - 1 )

The current implementation results in a buffer overrun.
A simple case can be reproduced using the following setting.

RANK = 2, N = 42, NRHS = 13, KL = 15, KU = 12, BLOCK = 30, LOCr(N) = 0
RANK = 0, N = 42, NRHS = 13, KL = 15, KU = 12, BLOCK = 30, LOCr(N) = 30
RANK = 1, N = 42, NRHS = 13, KL = 15, KU = 12, BLOCK = 30, LOCr(N) = 12

Maybe the minimum size shall be revised.
For simplicity, MAX_BW * ( 2 * NRHS - 1 ) or MAX_BW * 2 * NRHS.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions