Fix out of bounds write in array deserialization #29017
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Hmm, I wonder why we never saw any issues w/ the test here; is precompilation deserialization different in some way? |
The array was allocated based on the serialized `elsize` of the array, however, unions get an extra selector array after the regular storage which was not allocated (because we didn't know it was gonna be a union array at the time when we allocated it). According to a48eeef we cannot look at the element type to allocate the array, so we need to serialize a bit to indicate that we will have a union array. Fixes #28998
|
Yes, different serialization format, implemented in C and not user extensible, since it needs to be available without any julia code loaded. |
Merged
JeffBezanson
approved these changes
Sep 4, 2018
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The array was allocated based on the serialized
elsizeof the array,however, unions get an extra selector array after the regular storage
which was not allocated (because we didn't know it was gonna be a union
array at the time when we allocated it). According to
a48eeef we cannot look at the element
type to allocate the array, so we need to serialize a bit to indicate
that we will have a union array.
Fixes #28998