Stack buffer overflow in prepare_input_tensors() due to unchecked memcpy size - #16797

Merged
lucylq merged 1 commit into
mainfrom
lfq.check-size-before-memcpy
Jan 28, 2026
Merged

Stack buffer overflow in prepare_input_tensors() due to unchecked memcpy size#16797
lucylq merged 1 commit into
mainfrom
lfq.check-size-before-memcpy

Conversation

@lucylq

@lucylqlucylq commented Jan 22, 2026•
edited
Loading

Copy link
Copy Markdown
Contributor

Summary

Add size checks for int, double, bool before memcpying. Otherwise the input buffer may be larger than the intended size and overwrite adjacent memory.

Test Plan

(executorch) [lfq@devvm20128.prn0 /data/users/lfq/executorch/build (lfq.check-size-before-memcpy)]$ ctest -R extension_runner_util_test -V
...
54: [ RUN ] InputsTest.DoubleInputWrongSizeFails
54: E 00:00:00.001251 executorch:inputs.cpp:101] Double input at index 2 has size 16, expected sizeof(double) 8
54: [ OK ] InputsTest.DoubleInputWrongSizeFails (0 ms)
...
1/1 Test #54: extension_runner_util_test ....... Passed 0.01 sec
The following tests passed:
extension_runner_util_test
100% tests passed, 0 tests failed out of 1
Total Test time (real) = 0.01 sec

@pytorch-bot

pytorch-botBot commented Jan 22, 2026•
edited
Loading

Copy link
Copy Markdown

🔗 Helpful Links

🧪 See artifacts and rendered test results at hud.pytorch.org/pr/pytorch/executorch/16797

Note: Links to docs will display an error until the docs builds have been completed.

❌ 1 New Failure, 8 Pending

As of commit b1dadab with merge base 86b4bea (image):

NEW FAILURE - The following job has failed:

This comment was automatically generated by Dr. CI and updates every 15 minutes.

@meta-clameta-claBot added the CLA Signed This label is managed by the Facebook bot. Authors need to sign the CLA before a PR can be reviewed. label Jan 22, 2026
@github-actions

github-actionsBot commented Jan 22, 2026

Copy link
Copy Markdown

This PR needs a release notes: label

If your change should be included in the release notes (i.e. would users of this library care about this change?), please use a label starting with release notes:. This helps us keep track and include your important work in the next release notes.

To add a label, you can comment to pytorchbot, for example
@pytorchbot label "release notes: none"

For more information, see
https://github.com/pytorch/pytorch/wiki/PyTorch-AutoLabel-Bot#why-categorize-for-release-notes-and-how-does-it-work.

@lucylq
lucylq marked this pull request as ready for review January 22, 2026 21:22
CopilotAI reviewed Jan 22, 2026
View reviewed changes

CopilotAI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Mitigates a stack buffer overflow risk in prepare_input_tensors() by validating scalar input buffer sizes before copying into stack-allocated variables.

Changes:

  • Add strict size checks for Tag::Int (int64_t), Tag::Double (double), and Tag::Bool (bool) inputs prior to memcpy.
  • Return InvalidArgument with a descriptive error when the provided scalar buffer size is unexpected.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment threadextension/runner_util/inputs.cpp Outdated
Comment threadextension/runner_util/inputs.cpp Outdated
@mergennachin

mergennachin commented Jan 22, 2026

Copy link
Copy Markdown
Contributor

Can you add a regression test?

@lucylq
lucylqforce-pushed the lfq.check-size-before-memcpy branch from b0e5c6d to 8c8d7dcCompareJanuary 23, 2026 00:52
@lucylq
lucylq requested a review from CopilotJanuary 23, 2026 00:55
CopilotAI reviewed Jan 23, 2026
View reviewed changes

CopilotAI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 7 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment threadextension/runner_util/inputs.cpp Outdated
Comment threadextension/runner_util/inputs.cpp Outdated
Comment threadextension/runner_util/test/inputs_test.cpp Outdated
Comment threadextension/runner_util/test/inputs_test.cpp Outdated
Comment threadextension/runner_util/test/inputs_test.cpp Outdated
Comment threadextension/runner_util/test/inputs_test.cpp Outdated
Comment threadextension/runner_util/inputs.cpp Outdated
@lucylq
lucylqforce-pushed the lfq.check-size-before-memcpy branch from 8c8d7dc to c621f13CompareJanuary 23, 2026 01:13
CopilotAI review requested due to automatic review settings January 23, 2026 01:14
@lucylq
lucylqforce-pushed the lfq.check-size-before-memcpy branch from c621f13 to 33aa861CompareJanuary 23, 2026 01:14
@lucylq
lucylqforce-pushed the lfq.check-size-before-memcpy branch from 33aa861 to 8090b55CompareJanuary 23, 2026 01:14
CopilotAI reviewed Jan 23, 2026
View reviewed changes

CopilotAI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment threadextension/runner_util/inputs.cpp
@lucylq

lucylq commented Jan 23, 2026

Copy link
Copy Markdown
ContributorAuthor

Can you add a regression test?

@mergennachin added one for double. Feel like that should be OK as it's the same logic, and adding tests for bool/int would need new models to export_program.py that take in bool/int as input. But let me know what you think

larryliu0820
larryliu0820 reviewed Jan 27, 2026
View reviewed changes
Comment threadextension/runner_util/inputs.cpp
larryliu0820
larryliu0820 approved these changes Jan 27, 2026
View reviewed changes

@larryliu0820larryliu0820 left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Left some non-blocking comments

@lucylq
lucylqforce-pushed the lfq.check-size-before-memcpy branch from 8090b55 to 801f5a3CompareJanuary 27, 2026 23:01
@lucylq
lucylq requested a review from CopilotJanuary 27, 2026 23:04
CopilotAI reviewed Jan 27, 2026
View reviewed changes

CopilotAI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment threadextension/runner_util/test/CMakeLists.txt
@lucylq
lucylqforce-pushed the lfq.check-size-before-memcpy branch from 801f5a3 to e95bc65CompareJanuary 27, 2026 23:23
@lucylq
lucylq requested a review from CopilotJanuary 27, 2026 23:24
CopilotAI reviewed Jan 27, 2026
View reviewed changes

CopilotAI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 3 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment threadextension/runner_util/test/inputs_test.cpp Outdated
Comment threadextension/runner_util/test/inputs_test.cpp Outdated
Comment threadextension/runner_util/test/inputs_test.cpp
@lucylq
lucylqforce-pushed the lfq.check-size-before-memcpy branch from e95bc65 to 1f63405CompareJanuary 28, 2026 01:26
CopilotAI review requested due to automatic review settings January 28, 2026 01:31
@lucylq
lucylqforce-pushed the lfq.check-size-before-memcpy branch from 1f63405 to 9c75403CompareJanuary 28, 2026 01:31
CopilotAI reviewed Jan 28, 2026
View reviewed changes

CopilotAI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 4 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment threadextension/runner_util/test/inputs_test.cpp
Comment threadextension/runner_util/test/inputs_test.cpp Outdated
Comment threadextension/runner_util/test/inputs_test.cpp
Comment threadextension/runner_util/test/inputs_test.cpp
@lucylq
lucylqforce-pushed the lfq.check-size-before-memcpy branch from 9c75403 to b1dadabCompareJanuary 28, 2026 20:40
@lucylq
lucylq merged commit 161d535 into mainJan 28, 2026
169 of 172 checks passed
@lucylq
lucylq deleted the lfq.check-size-before-memcpy branch January 28, 2026 22:10
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code reviewCopilot
Copilot review effort, defaults to Lite
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@larryliu0820larryliu0820larryliu0820 approved these changes
@JacobSzwejbkaJacobSzwejbkaAwaiting requested review from JacobSzwejbka
@mergennachinmergennachinAwaiting requested review from mergennachin
@kirklandsignkirklandsignAwaiting requested review from kirklandsignkirklandsign is a code owner

Assignees

No one assigned

Labels

CLA SignedThis label is managed by the Facebook bot. Authors need to sign the CLA before a PR can be reviewed.security-fix

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@lucylq@mergennachin@larryliu0820
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
Stack buffer overflow in prepare_input_tensors() due to unchecked memcpy size - #16797
Merged
lucylq merged 1 commit into
mainfrom 
lfq.check-size-before-memcpy
Jan 28, 2026
Merged
Stack buffer overflow in prepare_input_tensors() due to unchecked memcpy size#16797
lucylq merged 1 commit into
mainfrom 
lfq.check-size-before-memcpy
Conversation
@lucylq
@lucylqlucylq
commented
Jan 22, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
Summary
Add size checks for int, double, bool before memcpying. Otherwise the input buffer may be larger than the intended size and overwrite adjacent memory.
Test Plan
(executorch) [lfq@devvm20128.prn0 /data/users/lfq/executorch/build (lfq.check-size-before-memcpy)]$ ctest -R extension_runner_util_test -V
...
54: [ RUN ] InputsTest.DoubleInputWrongSizeFails
54: E 00:00:00.001251 executorch:inputs.cpp:101] Double input at index 2 has size 16, expected sizeof(double) 8
54: [ OK ] InputsTest.DoubleInputWrongSizeFails (0 ms)
...
1/1 Test #54: extension_runner_util_test ....... Passed 0.01 sec
The following tests passed:
extension_runner_util_test
100% tests passed, 0 tests failed out of 1
Total Test time (real) = 0.01 sec

@pytorch-bot
pytorch-botBot
commented
Jan 22, 2026•

edited

Loading

Copy link


Copy Markdown

🔗 Helpful Links
🧪 See artifacts and rendered test results at hud.pytorch.org/pr/pytorch/executorch/16797
Note: Links to docs will display an error until the docs builds have been completed.
❌ 1 New Failure, 8 Pending
As of commit b1dadab with merge base 86b4bea (image):
NEW FAILURE - The following job has failed:
This comment was automatically generated by Dr. CI and updates every 15 minutes.
@meta-clameta-claBot
added
the 
CLA Signed
This label is managed by the Facebook bot. Authors need to sign the CLA before a PR can be reviewed.
label
Jan 22, 2026
@github-actions
github-actionsBot
commented
Jan 22, 2026

Copy link


Copy Markdown

This PR needs a release notes: label
If your change should be included in the release notes (i.e. would users of this library care about this change?), please use a label starting with release notes:. This helps us keep track and include your important work in the next release notes.
To add a label, you can comment to pytorchbot, for example
@pytorchbot label "release notes: none"
For more information, see
https://github.com/pytorch/pytorch/wiki/PyTorch-AutoLabel-Bot#why-categorize-for-release-notes-and-how-does-it-work.
@lucylq
lucylq
marked this pull request as ready for review
January 22, 2026 21:22
CopilotAI
reviewed
Jan 22, 2026
View reviewed changes
CopilotAI
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview
Mitigates a stack buffer overflow risk in prepare_input_tensors() by validating scalar input buffer sizes before copying into stack-allocated variables.
Changes:
  • Add strict size checks for Tag::Int (int64_t), Tag::Double (double), and Tag::Bool (bool) inputs prior to memcpy.
  • Return InvalidArgument with a descriptive error when the provided scalar buffer size is unexpected.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment threadextension/runner_util/inputs.cpp
Outdated

Comment threadextension/runner_util/inputs.cpp
Outdated

@mergennachin
mergennachin
commented
Jan 22, 2026

Copy link


Copy Markdown

Contributor
Can you add a regression test?
@lucylq
lucylqforce-pushed
the
lfq.check-size-before-memcpy
branch
from
b0e5c6d to
8c8d7dcCompareJanuary 23, 2026 00:52
@lucylq
lucylq
requested a review
from CopilotJanuary 23, 2026 00:55
CopilotAI
reviewed
Jan 23, 2026
View reviewed changes
CopilotAI
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview
Copilot reviewed 2 out of 2 changed files in this pull request and generated 7 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment threadextension/runner_util/inputs.cpp
Outdated

Comment threadextension/runner_util/inputs.cpp
Outdated

Comment threadextension/runner_util/test/inputs_test.cpp
Outdated

Comment threadextension/runner_util/test/inputs_test.cpp
Outdated

Comment threadextension/runner_util/test/inputs_test.cpp
Outdated

Comment threadextension/runner_util/test/inputs_test.cpp
Outdated

Comment threadextension/runner_util/inputs.cpp
Outdated

@lucylq
lucylqforce-pushed
the
lfq.check-size-before-memcpy
branch
from
8c8d7dc to
c621f13CompareJanuary 23, 2026 01:13
CopilotAI
review requested due to automatic review settings
January 23, 2026 01:14
@lucylq
lucylqforce-pushed
the
lfq.check-size-before-memcpy
branch
from
c621f13 to
33aa861CompareJanuary 23, 2026 01:14
@lucylq
lucylqforce-pushed
the
lfq.check-size-before-memcpy
branch
from
33aa861 to
8090b55CompareJanuary 23, 2026 01:14
CopilotAI
reviewed
Jan 23, 2026
View reviewed changes
CopilotAI
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment threadextension/runner_util/inputs.cpp
@lucylq
lucylq
commented
Jan 23, 2026

Copy link


Copy Markdown

ContributorAuthor
Can you add a regression test?
@mergennachin added one for double. Feel like that should be OK as it's the same logic, and adding tests for bool/int would need new models to export_program.py that take in bool/int as input. But let me know what you think
larryliu0820
larryliu0820
reviewed
Jan 27, 2026
View reviewed changes
Comment threadextension/runner_util/inputs.cpp
larryliu0820
larryliu0820
approved these changes
Jan 27, 2026
View reviewed changes
@larryliu0820larryliu0820
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Left some non-blocking comments
@lucylq
lucylqforce-pushed
the
lfq.check-size-before-memcpy
branch
from
8090b55 to
801f5a3CompareJanuary 27, 2026 23:01
@lucylq
lucylq
requested a review
from CopilotJanuary 27, 2026 23:04
CopilotAI
reviewed
Jan 27, 2026
View reviewed changes
CopilotAI
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview
Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment threadextension/runner_util/test/CMakeLists.txt
@lucylq
lucylqforce-pushed
the
lfq.check-size-before-memcpy
branch
from
801f5a3 to
e95bc65CompareJanuary 27, 2026 23:23
@lucylq
lucylq
requested a review
from CopilotJanuary 27, 2026 23:24
CopilotAI
reviewed
Jan 27, 2026
View reviewed changes
CopilotAI
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview
Copilot reviewed 6 out of 6 changed files in this pull request and generated 3 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment threadextension/runner_util/test/inputs_test.cpp
Outdated

Comment threadextension/runner_util/test/inputs_test.cpp
Outdated

Comment threadextension/runner_util/test/inputs_test.cpp
@lucylq
lucylqforce-pushed
the
lfq.check-size-before-memcpy
branch
from
e95bc65 to
1f63405CompareJanuary 28, 2026 01:26
CopilotAI
review requested due to automatic review settings
January 28, 2026 01:31
@lucylq
lucylqforce-pushed
the
lfq.check-size-before-memcpy
branch
from
1f63405 to
9c75403CompareJanuary 28, 2026 01:31
CopilotAI
reviewed
Jan 28, 2026
View reviewed changes
CopilotAI
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview
Copilot reviewed 6 out of 6 changed files in this pull request and generated 4 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment threadextension/runner_util/test/inputs_test.cpp
Comment threadextension/runner_util/test/inputs_test.cpp
Outdated

Comment threadextension/runner_util/test/inputs_test.cpp
Comment threadextension/runner_util/test/inputs_test.cpp
@lucylq
lucylqforce-pushed
the
lfq.check-size-before-memcpy
branch
from
9c75403 to
b1dadabCompareJanuary 28, 2026 20:40
@lucylq
lucylq
merged commit 161d535
into
mainJan 28, 2026

169 of 172 checks passed

@lucylq
lucylq
deleted the

lfq.check-size-before-memcpy

branch
January 28, 2026 22:10
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

Copilot code reviewCopilot
Copilot review effort, defaults to Lite
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@larryliu0820larryliu0820larryliu0820 approved these changes
@JacobSzwejbkaJacobSzwejbkaAwaiting requested review from JacobSzwejbka
@mergennachinmergennachinAwaiting requested review from mergennachin
@kirklandsignkirklandsignAwaiting requested review from kirklandsignkirklandsign is a code owner

Assignees


No one assigned


Labels

CLA SignedThis label is managed by the Facebook bot. Authors need to sign the CLA before a PR can be reviewed.security-fix

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

4 participants

@lucylq@mergennachin@larryliu0820

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Stack buffer overflow in prepare_input_tensors() due to unchecked memcpy size - #16797
Merged
lucylq merged 1 commit into
mainfrom 
lfq.check-size-before-memcpy
Jan 28, 2026
Merged
Stack buffer overflow in prepare_input_tensors() due to unchecked memcpy size#16797
lucylq merged 1 commit into
mainfrom 
lfq.check-size-before-memcpy
Conversation
@lucylq
@lucylqlucylq
commented
Jan 22, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
Summary
Add size checks for int, double, bool before memcpying. Otherwise the input buffer may be larger than the intended size and overwrite adjacent memory.
Test Plan
(executorch) [lfq@devvm20128.prn0 /data/users/lfq/executorch/build (lfq.check-size-before-memcpy)]$ ctest -R extension_runner_util_test -V
...
54: [ RUN ] InputsTest.DoubleInputWrongSizeFails
54: E 00:00:00.001251 executorch:inputs.cpp:101] Double input at index 2 has size 16, expected sizeof(double) 8
54: [ OK ] InputsTest.DoubleInputWrongSizeFails (0 ms)
...
1/1 Test #54: extension_runner_util_test ....... Passed 0.01 sec
The following tests passed:
extension_runner_util_test
100% tests passed, 0 tests failed out of 1
Total Test time (real) = 0.01 sec

@pytorch-bot
pytorch-botBot
commented
Jan 22, 2026•

edited

Loading

Copy link


Copy Markdown

🔗 Helpful Links
🧪 See artifacts and rendered test results at hud.pytorch.org/pr/pytorch/executorch/16797
Note: Links to docs will display an error until the docs builds have been completed.
❌ 1 New Failure, 8 Pending
As of commit b1dadab with merge base 86b4bea (image):
NEW FAILURE - The following job has failed:
This comment was automatically generated by Dr. CI and updates every 15 minutes.
@meta-clameta-claBot
added
the 
CLA Signed
This label is managed by the Facebook bot. Authors need to sign the CLA before a PR can be reviewed.
label
Jan 22, 2026
@github-actions
github-actionsBot
commented
Jan 22, 2026

Copy link


Copy Markdown

This PR needs a release notes: label
If your change should be included in the release notes (i.e. would users of this library care about this change?), please use a label starting with release notes:. This helps us keep track and include your important work in the next release notes.
To add a label, you can comment to pytorchbot, for example
@pytorchbot label "release notes: none"
For more information, see
https://github.com/pytorch/pytorch/wiki/PyTorch-AutoLabel-Bot#why-categorize-for-release-notes-and-how-does-it-work.
@lucylq
lucylq
marked this pull request as ready for review
January 22, 2026 21:22
CopilotAI
reviewed
Jan 22, 2026
View reviewed changes
CopilotAI
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview
Mitigates a stack buffer overflow risk in prepare_input_tensors() by validating scalar input buffer sizes before copying into stack-allocated variables.
Changes:
  • Add strict size checks for Tag::Int (int64_t), Tag::Double (double), and Tag::Bool (bool) inputs prior to memcpy.
  • Return InvalidArgument with a descriptive error when the provided scalar buffer size is unexpected.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment threadextension/runner_util/inputs.cpp
Outdated

Comment threadextension/runner_util/inputs.cpp
Outdated

@mergennachin
mergennachin
commented
Jan 22, 2026

Copy link


Copy Markdown

Contributor
Can you add a regression test?
@lucylq
lucylqforce-pushed
the
lfq.check-size-before-memcpy
branch
from
b0e5c6d to
8c8d7dcCompareJanuary 23, 2026 00:52
@lucylq
lucylq
requested a review
from CopilotJanuary 23, 2026 00:55
CopilotAI
reviewed
Jan 23, 2026
View reviewed changes
CopilotAI
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview
Copilot reviewed 2 out of 2 changed files in this pull request and generated 7 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment threadextension/runner_util/inputs.cpp
Outdated

Comment threadextension/runner_util/inputs.cpp
Outdated

Comment threadextension/runner_util/test/inputs_test.cpp
Outdated

Comment threadextension/runner_util/test/inputs_test.cpp
Outdated

Comment threadextension/runner_util/test/inputs_test.cpp
Outdated

Comment threadextension/runner_util/test/inputs_test.cpp
Outdated

Comment threadextension/runner_util/inputs.cpp
Outdated

@lucylq
lucylqforce-pushed
the
lfq.check-size-before-memcpy
branch
from
8c8d7dc to
c621f13CompareJanuary 23, 2026 01:13
CopilotAI
review requested due to automatic review settings
January 23, 2026 01:14
@lucylq
lucylqforce-pushed
the
lfq.check-size-before-memcpy
branch
from
c621f13 to
33aa861CompareJanuary 23, 2026 01:14
@lucylq
lucylqforce-pushed
the
lfq.check-size-before-memcpy
branch
from
33aa861 to
8090b55CompareJanuary 23, 2026 01:14
CopilotAI
reviewed
Jan 23, 2026
View reviewed changes
CopilotAI
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment threadextension/runner_util/inputs.cpp
@lucylq
lucylq
commented
Jan 23, 2026

Copy link


Copy Markdown

ContributorAuthor
Can you add a regression test?
@mergennachin added one for double. Feel like that should be OK as it's the same logic, and adding tests for bool/int would need new models to export_program.py that take in bool/int as input. But let me know what you think
larryliu0820
larryliu0820
reviewed
Jan 27, 2026
View reviewed changes
Comment threadextension/runner_util/inputs.cpp
larryliu0820
larryliu0820
approved these changes
Jan 27, 2026
View reviewed changes
@larryliu0820larryliu0820
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Left some non-blocking comments
@lucylq
lucylqforce-pushed
the
lfq.check-size-before-memcpy
branch
from
8090b55 to
801f5a3CompareJanuary 27, 2026 23:01
@lucylq
lucylq
requested a review
from CopilotJanuary 27, 2026 23:04
CopilotAI
reviewed
Jan 27, 2026
View reviewed changes
CopilotAI
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview
Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment threadextension/runner_util/test/CMakeLists.txt
@lucylq
lucylqforce-pushed
the
lfq.check-size-before-memcpy
branch
from
801f5a3 to
e95bc65CompareJanuary 27, 2026 23:23
@lucylq
lucylq
requested a review
from CopilotJanuary 27, 2026 23:24
CopilotAI
reviewed
Jan 27, 2026
View reviewed changes
CopilotAI
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview
Copilot reviewed 6 out of 6 changed files in this pull request and generated 3 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment threadextension/runner_util/test/inputs_test.cpp
Outdated

Comment threadextension/runner_util/test/inputs_test.cpp
Outdated

Comment threadextension/runner_util/test/inputs_test.cpp
@lucylq
lucylqforce-pushed
the
lfq.check-size-before-memcpy
branch
from
e95bc65 to
1f63405CompareJanuary 28, 2026 01:26
CopilotAI
review requested due to automatic review settings
January 28, 2026 01:31
@lucylq
lucylqforce-pushed
the
lfq.check-size-before-memcpy
branch
from
1f63405 to
9c75403CompareJanuary 28, 2026 01:31
CopilotAI
reviewed
Jan 28, 2026
View reviewed changes
CopilotAI
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview
Copilot reviewed 6 out of 6 changed files in this pull request and generated 4 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment threadextension/runner_util/test/inputs_test.cpp
Comment threadextension/runner_util/test/inputs_test.cpp
Outdated

Comment threadextension/runner_util/test/inputs_test.cpp
Comment threadextension/runner_util/test/inputs_test.cpp
@lucylq
lucylqforce-pushed
the
lfq.check-size-before-memcpy
branch
from
9c75403 to
b1dadabCompareJanuary 28, 2026 20:40
@lucylq
lucylq
merged commit 161d535
into
mainJan 28, 2026

169 of 172 checks passed

@lucylq
lucylq
deleted the

lfq.check-size-before-memcpy

branch
January 28, 2026 22:10
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

Copilot code reviewCopilot
Copilot review effort, defaults to Lite
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@larryliu0820larryliu0820larryliu0820 approved these changes
@JacobSzwejbkaJacobSzwejbkaAwaiting requested review from JacobSzwejbka
@mergennachinmergennachinAwaiting requested review from mergennachin
@kirklandsignkirklandsignAwaiting requested review from kirklandsignkirklandsign is a code owner

Assignees


No one assigned


Labels

CLA SignedThis label is managed by the Facebook bot. Authors need to sign the CLA before a PR can be reviewed.security-fix

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

4 participants

@lucylq@mergennachin@larryliu0820

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Stack buffer overflow in prepare_input_tensors() due to unchecked memcpy size - #16797
Merged
lucylq merged 1 commit into
mainfrom 
lfq.check-size-before-memcpy
Jan 28, 2026
Merged
Stack buffer overflow in prepare_input_tensors() due to unchecked memcpy size#16797
lucylq merged 1 commit into
mainfrom 
lfq.check-size-before-memcpy
Conversation
@lucylq
@lucylqlucylq
commented
Jan 22, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
Summary
Add size checks for int, double, bool before memcpying. Otherwise the input buffer may be larger than the intended size and overwrite adjacent memory.
Test Plan
(executorch) [lfq@devvm20128.prn0 /data/users/lfq/executorch/build (lfq.check-size-before-memcpy)]$ ctest -R extension_runner_util_test -V
...
54: [ RUN ] InputsTest.DoubleInputWrongSizeFails
54: E 00:00:00.001251 executorch:inputs.cpp:101] Double input at index 2 has size 16, expected sizeof(double) 8
54: [ OK ] InputsTest.DoubleInputWrongSizeFails (0 ms)
...
1/1 Test #54: extension_runner_util_test ....... Passed 0.01 sec
The following tests passed:
extension_runner_util_test
100% tests passed, 0 tests failed out of 1
Total Test time (real) = 0.01 sec

@pytorch-bot
pytorch-botBot
commented
Jan 22, 2026•

edited

Loading

Copy link


Copy Markdown

🔗 Helpful Links
🧪 See artifacts and rendered test results at hud.pytorch.org/pr/pytorch/executorch/16797
Note: Links to docs will display an error until the docs builds have been completed.
❌ 1 New Failure, 8 Pending
As of commit b1dadab with merge base 86b4bea (image):
NEW FAILURE - The following job has failed:
This comment was automatically generated by Dr. CI and updates every 15 minutes.
@meta-clameta-claBot
added
the 
CLA Signed
This label is managed by the Facebook bot. Authors need to sign the CLA before a PR can be reviewed.
label
Jan 22, 2026
@github-actions
github-actionsBot
commented
Jan 22, 2026

Copy link


Copy Markdown

This PR needs a release notes: label
If your change should be included in the release notes (i.e. would users of this library care about this change?), please use a label starting with release notes:. This helps us keep track and include your important work in the next release notes.
To add a label, you can comment to pytorchbot, for example
@pytorchbot label "release notes: none"
For more information, see
https://github.com/pytorch/pytorch/wiki/PyTorch-AutoLabel-Bot#why-categorize-for-release-notes-and-how-does-it-work.
@lucylq
lucylq
marked this pull request as ready for review
January 22, 2026 21:22
CopilotAI
reviewed
Jan 22, 2026
View reviewed changes
CopilotAI
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview
Mitigates a stack buffer overflow risk in prepare_input_tensors() by validating scalar input buffer sizes before copying into stack-allocated variables.
Changes:
  • Add strict size checks for Tag::Int (int64_t), Tag::Double (double), and Tag::Bool (bool) inputs prior to memcpy.
  • Return InvalidArgument with a descriptive error when the provided scalar buffer size is unexpected.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment threadextension/runner_util/inputs.cpp
Outdated

Comment threadextension/runner_util/inputs.cpp
Outdated

@mergennachin
mergennachin
commented
Jan 22, 2026

Copy link


Copy Markdown

Contributor
Can you add a regression test?
@lucylq
lucylqforce-pushed
the
lfq.check-size-before-memcpy
branch
from
b0e5c6d to
8c8d7dcCompareJanuary 23, 2026 00:52
@lucylq
lucylq
requested a review
from CopilotJanuary 23, 2026 00:55
CopilotAI
reviewed
Jan 23, 2026
View reviewed changes
CopilotAI
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview
Copilot reviewed 2 out of 2 changed files in this pull request and generated 7 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment threadextension/runner_util/inputs.cpp
Outdated

Comment threadextension/runner_util/inputs.cpp
Outdated

Comment threadextension/runner_util/test/inputs_test.cpp
Outdated

Comment threadextension/runner_util/test/inputs_test.cpp
Outdated

Comment threadextension/runner_util/test/inputs_test.cpp
Outdated

Comment threadextension/runner_util/test/inputs_test.cpp
Outdated

Comment threadextension/runner_util/inputs.cpp
Outdated

@lucylq
lucylqforce-pushed
the
lfq.check-size-before-memcpy
branch
from
8c8d7dc to
c621f13CompareJanuary 23, 2026 01:13
CopilotAI
review requested due to automatic review settings
January 23, 2026 01:14
@lucylq
lucylqforce-pushed
the
lfq.check-size-before-memcpy
branch
from
c621f13 to
33aa861CompareJanuary 23, 2026 01:14
@lucylq
lucylqforce-pushed
the
lfq.check-size-before-memcpy
branch
from
33aa861 to
8090b55CompareJanuary 23, 2026 01:14
CopilotAI
reviewed
Jan 23, 2026
View reviewed changes
CopilotAI
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment threadextension/runner_util/inputs.cpp
@lucylq
lucylq
commented
Jan 23, 2026

Copy link


Copy Markdown

ContributorAuthor
Can you add a regression test?
@mergennachin added one for double. Feel like that should be OK as it's the same logic, and adding tests for bool/int would need new models to export_program.py that take in bool/int as input. But let me know what you think
larryliu0820
larryliu0820
reviewed
Jan 27, 2026
View reviewed changes
Comment threadextension/runner_util/inputs.cpp
larryliu0820
larryliu0820
approved these changes
Jan 27, 2026
View reviewed changes
@larryliu0820larryliu0820
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Left some non-blocking comments
@lucylq
lucylqforce-pushed
the
lfq.check-size-before-memcpy
branch
from
8090b55 to
801f5a3CompareJanuary 27, 2026 23:01
@lucylq
lucylq
requested a review
from CopilotJanuary 27, 2026 23:04
CopilotAI
reviewed
Jan 27, 2026
View reviewed changes
CopilotAI
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview
Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment threadextension/runner_util/test/CMakeLists.txt
@lucylq
lucylqforce-pushed
the
lfq.check-size-before-memcpy
branch
from
801f5a3 to
e95bc65CompareJanuary 27, 2026 23:23
@lucylq
lucylq
requested a review
from CopilotJanuary 27, 2026 23:24
CopilotAI
reviewed
Jan 27, 2026
View reviewed changes
CopilotAI
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview
Copilot reviewed 6 out of 6 changed files in this pull request and generated 3 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment threadextension/runner_util/test/inputs_test.cpp
Outdated

Comment threadextension/runner_util/test/inputs_test.cpp
Outdated

Comment threadextension/runner_util/test/inputs_test.cpp
@lucylq
lucylqforce-pushed
the
lfq.check-size-before-memcpy
branch
from
e95bc65 to
1f63405CompareJanuary 28, 2026 01:26
CopilotAI
review requested due to automatic review settings
January 28, 2026 01:31
@lucylq
lucylqforce-pushed
the
lfq.check-size-before-memcpy
branch
from
1f63405 to
9c75403CompareJanuary 28, 2026 01:31
CopilotAI
reviewed
Jan 28, 2026
View reviewed changes
CopilotAI
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview
Copilot reviewed 6 out of 6 changed files in this pull request and generated 4 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment threadextension/runner_util/test/inputs_test.cpp
Comment threadextension/runner_util/test/inputs_test.cpp
Outdated

Comment threadextension/runner_util/test/inputs_test.cpp
Comment threadextension/runner_util/test/inputs_test.cpp
@lucylq
lucylqforce-pushed
the
lfq.check-size-before-memcpy
branch
from
9c75403 to
b1dadabCompareJanuary 28, 2026 20:40
@lucylq
lucylq
merged commit 161d535
into
mainJan 28, 2026

169 of 172 checks passed

@lucylq
lucylq
deleted the

lfq.check-size-before-memcpy

branch
January 28, 2026 22:10
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

Copilot code reviewCopilot
Copilot review effort, defaults to Lite
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@larryliu0820larryliu0820larryliu0820 approved these changes
@JacobSzwejbkaJacobSzwejbkaAwaiting requested review from JacobSzwejbka
@mergennachinmergennachinAwaiting requested review from mergennachin
@kirklandsignkirklandsignAwaiting requested review from kirklandsignkirklandsign is a code owner

Assignees


No one assigned


Labels

CLA SignedThis label is managed by the Facebook bot. Authors need to sign the CLA before a PR can be reviewed.security-fix

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

4 participants

@lucylq@mergennachin@larryliu0820

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
Stack buffer overflow in prepare_input_tensors() due to unchecked memcpy size - #16797
Merged
lucylq merged 1 commit into
mainfrom 
lfq.check-size-before-memcpy
Jan 28, 2026
Merged
Stack buffer overflow in prepare_input_tensors() due to unchecked memcpy size#16797
lucylq merged 1 commit into
mainfrom 
lfq.check-size-before-memcpy
Conversation
@lucylq
@lucylqlucylq
commented
Jan 22, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
Summary
Add size checks for int, double, bool before memcpying. Otherwise the input buffer may be larger than the intended size and overwrite adjacent memory.
Test Plan
(executorch) [lfq@devvm20128.prn0 /data/users/lfq/executorch/build (lfq.check-size-before-memcpy)]$ ctest -R extension_runner_util_test -V
...
54: [ RUN ] InputsTest.DoubleInputWrongSizeFails
54: E 00:00:00.001251 executorch:inputs.cpp:101] Double input at index 2 has size 16, expected sizeof(double) 8
54: [ OK ] InputsTest.DoubleInputWrongSizeFails (0 ms)
...
1/1 Test #54: extension_runner_util_test ....... Passed 0.01 sec
The following tests passed:
extension_runner_util_test
100% tests passed, 0 tests failed out of 1
Total Test time (real) = 0.01 sec

@pytorch-bot
pytorch-botBot
commented
Jan 22, 2026•

edited

Loading

Copy link


Copy Markdown

🔗 Helpful Links
🧪 See artifacts and rendered test results at hud.pytorch.org/pr/pytorch/executorch/16797
Note: Links to docs will display an error until the docs builds have been completed.
❌ 1 New Failure, 8 Pending
As of commit b1dadab with merge base 86b4bea (image):
NEW FAILURE - The following job has failed:
This comment was automatically generated by Dr. CI and updates every 15 minutes.
@meta-clameta-claBot
added
the 
CLA Signed
This label is managed by the Facebook bot. Authors need to sign the CLA before a PR can be reviewed.
label
Jan 22, 2026
@github-actions
github-actionsBot
commented
Jan 22, 2026

Copy link


Copy Markdown

This PR needs a release notes: label
If your change should be included in the release notes (i.e. would users of this library care about this change?), please use a label starting with release notes:. This helps us keep track and include your important work in the next release notes.
To add a label, you can comment to pytorchbot, for example
@pytorchbot label "release notes: none"
For more information, see
https://github.com/pytorch/pytorch/wiki/PyTorch-AutoLabel-Bot#why-categorize-for-release-notes-and-how-does-it-work.
@lucylq
lucylq
marked this pull request as ready for review
January 22, 2026 21:22
CopilotAI
reviewed
Jan 22, 2026
View reviewed changes
CopilotAI
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview
Mitigates a stack buffer overflow risk in prepare_input_tensors() by validating scalar input buffer sizes before copying into stack-allocated variables.
Changes:
  • Add strict size checks for Tag::Int (int64_t), Tag::Double (double), and Tag::Bool (bool) inputs prior to memcpy.
  • Return InvalidArgument with a descriptive error when the provided scalar buffer size is unexpected.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment threadextension/runner_util/inputs.cpp
Outdated

Comment threadextension/runner_util/inputs.cpp
Outdated

@mergennachin
mergennachin
commented
Jan 22, 2026

Copy link


Copy Markdown

Contributor
Can you add a regression test?
@lucylq
lucylqforce-pushed
the
lfq.check-size-before-memcpy
branch
from
b0e5c6d to
8c8d7dcCompareJanuary 23, 2026 00:52
@lucylq
lucylq
requested a review
from CopilotJanuary 23, 2026 00:55
CopilotAI
reviewed
Jan 23, 2026
View reviewed changes
CopilotAI
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview
Copilot reviewed 2 out of 2 changed files in this pull request and generated 7 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment threadextension/runner_util/inputs.cpp
Outdated

Comment threadextension/runner_util/inputs.cpp
Outdated

Comment threadextension/runner_util/test/inputs_test.cpp
Outdated

Comment threadextension/runner_util/test/inputs_test.cpp
Outdated

Comment threadextension/runner_util/test/inputs_test.cpp
Outdated

Comment threadextension/runner_util/test/inputs_test.cpp
Outdated

Comment threadextension/runner_util/inputs.cpp
Outdated

@lucylq
lucylqforce-pushed
the
lfq.check-size-before-memcpy
branch
from
8c8d7dc to
c621f13CompareJanuary 23, 2026 01:13
CopilotAI
review requested due to automatic review settings
January 23, 2026 01:14
@lucylq
lucylqforce-pushed
the
lfq.check-size-before-memcpy
branch
from
c621f13 to
33aa861CompareJanuary 23, 2026 01:14
@lucylq
lucylqforce-pushed
the
lfq.check-size-before-memcpy
branch
from
33aa861 to
8090b55CompareJanuary 23, 2026 01:14
CopilotAI
reviewed
Jan 23, 2026
View reviewed changes
CopilotAI
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment threadextension/runner_util/inputs.cpp
@lucylq
lucylq
commented
Jan 23, 2026

Copy link


Copy Markdown

ContributorAuthor
Can you add a regression test?
@mergennachin added one for double. Feel like that should be OK as it's the same logic, and adding tests for bool/int would need new models to export_program.py that take in bool/int as input. But let me know what you think
larryliu0820
larryliu0820
reviewed
Jan 27, 2026
View reviewed changes
Comment threadextension/runner_util/inputs.cpp
larryliu0820
larryliu0820
approved these changes
Jan 27, 2026
View reviewed changes
@larryliu0820larryliu0820
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Left some non-blocking comments
@lucylq
lucylqforce-pushed
the
lfq.check-size-before-memcpy
branch
from
8090b55 to
801f5a3CompareJanuary 27, 2026 23:01
@lucylq
lucylq
requested a review
from CopilotJanuary 27, 2026 23:04
CopilotAI
reviewed
Jan 27, 2026
View reviewed changes
CopilotAI
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview
Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment threadextension/runner_util/test/CMakeLists.txt
@lucylq
lucylqforce-pushed
the
lfq.check-size-before-memcpy
branch
from
801f5a3 to
e95bc65CompareJanuary 27, 2026 23:23
@lucylq
lucylq
requested a review
from CopilotJanuary 27, 2026 23:24
CopilotAI
reviewed
Jan 27, 2026
View reviewed changes
CopilotAI
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview
Copilot reviewed 6 out of 6 changed files in this pull request and generated 3 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment threadextension/runner_util/test/inputs_test.cpp
Outdated

Comment threadextension/runner_util/test/inputs_test.cpp
Outdated

Comment threadextension/runner_util/test/inputs_test.cpp
@lucylq
lucylqforce-pushed
the
lfq.check-size-before-memcpy
branch
from
e95bc65 to
1f63405CompareJanuary 28, 2026 01:26
CopilotAI
review requested due to automatic review settings
January 28, 2026 01:31
@lucylq
lucylqforce-pushed
the
lfq.check-size-before-memcpy
branch
from
1f63405 to
9c75403CompareJanuary 28, 2026 01:31
CopilotAI
reviewed
Jan 28, 2026
View reviewed changes
CopilotAI
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview
Copilot reviewed 6 out of 6 changed files in this pull request and generated 4 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment threadextension/runner_util/test/inputs_test.cpp
Comment threadextension/runner_util/test/inputs_test.cpp
Outdated

Comment threadextension/runner_util/test/inputs_test.cpp
Comment threadextension/runner_util/test/inputs_test.cpp
@lucylq
lucylqforce-pushed
the
lfq.check-size-before-memcpy
branch
from
9c75403 to
b1dadabCompareJanuary 28, 2026 20:40
@lucylq
lucylq
merged commit 161d535
into
mainJan 28, 2026

169 of 172 checks passed

@lucylq
lucylq
deleted the

lfq.check-size-before-memcpy

branch
January 28, 2026 22:10
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

Copilot code reviewCopilot
Copilot review effort, defaults to Lite
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@larryliu0820larryliu0820larryliu0820 approved these changes
@JacobSzwejbkaJacobSzwejbkaAwaiting requested review from JacobSzwejbka
@mergennachinmergennachinAwaiting requested review from mergennachin
@kirklandsignkirklandsignAwaiting requested review from kirklandsignkirklandsign is a code owner

Assignees


No one assigned


Labels

CLA SignedThis label is managed by the Facebook bot. Authors need to sign the CLA before a PR can be reviewed.security-fix

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

4 participants

@lucylq@mergennachin@larryliu0820

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Stack buffer overflow in prepare_input_tensors() due to unchecked memcpy size - #16797
Merged
lucylq merged 1 commit into
mainfrom 
lfq.check-size-before-memcpy
Jan 28, 2026
Merged
Stack buffer overflow in prepare_input_tensors() due to unchecked memcpy size#16797
lucylq merged 1 commit into
mainfrom 
lfq.check-size-before-memcpy
Conversation
@lucylq
@lucylqlucylq
commented
Jan 22, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
Summary
Add size checks for int, double, bool before memcpying. Otherwise the input buffer may be larger than the intended size and overwrite adjacent memory.
Test Plan
(executorch) [lfq@devvm20128.prn0 /data/users/lfq/executorch/build (lfq.check-size-before-memcpy)]$ ctest -R extension_runner_util_test -V
...
54: [ RUN ] InputsTest.DoubleInputWrongSizeFails
54: E 00:00:00.001251 executorch:inputs.cpp:101] Double input at index 2 has size 16, expected sizeof(double) 8
54: [ OK ] InputsTest.DoubleInputWrongSizeFails (0 ms)
...
1/1 Test #54: extension_runner_util_test ....... Passed 0.01 sec
The following tests passed:
extension_runner_util_test
100% tests passed, 0 tests failed out of 1
Total Test time (real) = 0.01 sec

@pytorch-bot
pytorch-botBot
commented
Jan 22, 2026•

edited

Loading

Copy link


Copy Markdown

🔗 Helpful Links
🧪 See artifacts and rendered test results at hud.pytorch.org/pr/pytorch/executorch/16797
Note: Links to docs will display an error until the docs builds have been completed.
❌ 1 New Failure, 8 Pending
As of commit b1dadab with merge base 86b4bea (image):
NEW FAILURE - The following job has failed:
This comment was automatically generated by Dr. CI and updates every 15 minutes.
@meta-clameta-claBot
added
the 
CLA Signed
This label is managed by the Facebook bot. Authors need to sign the CLA before a PR can be reviewed.
label
Jan 22, 2026
@github-actions
github-actionsBot
commented
Jan 22, 2026

Copy link


Copy Markdown

This PR needs a release notes: label
If your change should be included in the release notes (i.e. would users of this library care about this change?), please use a label starting with release notes:. This helps us keep track and include your important work in the next release notes.
To add a label, you can comment to pytorchbot, for example
@pytorchbot label "release notes: none"
For more information, see
https://github.com/pytorch/pytorch/wiki/PyTorch-AutoLabel-Bot#why-categorize-for-release-notes-and-how-does-it-work.
@lucylq
lucylq
marked this pull request as ready for review
January 22, 2026 21:22
CopilotAI
reviewed
Jan 22, 2026
View reviewed changes
CopilotAI
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview
Mitigates a stack buffer overflow risk in prepare_input_tensors() by validating scalar input buffer sizes before copying into stack-allocated variables.
Changes:
  • Add strict size checks for Tag::Int (int64_t), Tag::Double (double), and Tag::Bool (bool) inputs prior to memcpy.
  • Return InvalidArgument with a descriptive error when the provided scalar buffer size is unexpected.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment threadextension/runner_util/inputs.cpp
Outdated

Comment threadextension/runner_util/inputs.cpp
Outdated

@mergennachin
mergennachin
commented
Jan 22, 2026

Copy link


Copy Markdown

Contributor
Can you add a regression test?
@lucylq
lucylqforce-pushed
the
lfq.check-size-before-memcpy
branch
from
b0e5c6d to
8c8d7dcCompareJanuary 23, 2026 00:52
@lucylq
lucylq
requested a review
from CopilotJanuary 23, 2026 00:55
CopilotAI
reviewed
Jan 23, 2026
View reviewed changes
CopilotAI
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview
Copilot reviewed 2 out of 2 changed files in this pull request and generated 7 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment threadextension/runner_util/inputs.cpp
Outdated

Comment threadextension/runner_util/inputs.cpp
Outdated

Comment threadextension/runner_util/test/inputs_test.cpp
Outdated

Comment threadextension/runner_util/test/inputs_test.cpp
Outdated

Comment threadextension/runner_util/test/inputs_test.cpp
Outdated

Comment threadextension/runner_util/test/inputs_test.cpp
Outdated

Comment threadextension/runner_util/inputs.cpp
Outdated

@lucylq
lucylqforce-pushed
the
lfq.check-size-before-memcpy
branch
from
8c8d7dc to
c621f13CompareJanuary 23, 2026 01:13
CopilotAI
review requested due to automatic review settings
January 23, 2026 01:14
@lucylq
lucylqforce-pushed
the
lfq.check-size-before-memcpy
branch
from
c621f13 to
33aa861CompareJanuary 23, 2026 01:14
@lucylq
lucylqforce-pushed
the
lfq.check-size-before-memcpy
branch
from
33aa861 to
8090b55CompareJanuary 23, 2026 01:14
CopilotAI
reviewed
Jan 23, 2026
View reviewed changes
CopilotAI
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment threadextension/runner_util/inputs.cpp
@lucylq
lucylq
commented
Jan 23, 2026

Copy link


Copy Markdown

ContributorAuthor
Can you add a regression test?
@mergennachin added one for double. Feel like that should be OK as it's the same logic, and adding tests for bool/int would need new models to export_program.py that take in bool/int as input. But let me know what you think
larryliu0820
larryliu0820
reviewed
Jan 27, 2026
View reviewed changes
Comment threadextension/runner_util/inputs.cpp
larryliu0820
larryliu0820
approved these changes
Jan 27, 2026
View reviewed changes
@larryliu0820larryliu0820
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Left some non-blocking comments
@lucylq
lucylqforce-pushed
the
lfq.check-size-before-memcpy
branch
from
8090b55 to
801f5a3CompareJanuary 27, 2026 23:01
@lucylq
lucylq
requested a review
from CopilotJanuary 27, 2026 23:04
CopilotAI
reviewed
Jan 27, 2026
View reviewed changes
CopilotAI
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview
Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment threadextension/runner_util/test/CMakeLists.txt
@lucylq
lucylqforce-pushed
the
lfq.check-size-before-memcpy
branch
from
801f5a3 to
e95bc65CompareJanuary 27, 2026 23:23
@lucylq
lucylq
requested a review
from CopilotJanuary 27, 2026 23:24
CopilotAI
reviewed
Jan 27, 2026
View reviewed changes
CopilotAI
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview
Copilot reviewed 6 out of 6 changed files in this pull request and generated 3 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment threadextension/runner_util/test/inputs_test.cpp
Outdated

Comment threadextension/runner_util/test/inputs_test.cpp
Outdated

Comment threadextension/runner_util/test/inputs_test.cpp
@lucylq
lucylqforce-pushed
the
lfq.check-size-before-memcpy
branch
from
e95bc65 to
1f63405CompareJanuary 28, 2026 01:26
CopilotAI
review requested due to automatic review settings
January 28, 2026 01:31
@lucylq
lucylqforce-pushed
the
lfq.check-size-before-memcpy
branch
from
1f63405 to
9c75403CompareJanuary 28, 2026 01:31
CopilotAI
reviewed
Jan 28, 2026
View reviewed changes
CopilotAI
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview
Copilot reviewed 6 out of 6 changed files in this pull request and generated 4 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment threadextension/runner_util/test/inputs_test.cpp
Comment threadextension/runner_util/test/inputs_test.cpp
Outdated

Comment threadextension/runner_util/test/inputs_test.cpp
Comment threadextension/runner_util/test/inputs_test.cpp
@lucylq
lucylqforce-pushed
the
lfq.check-size-before-memcpy
branch
from
9c75403 to
b1dadabCompareJanuary 28, 2026 20:40
@lucylq
lucylq
merged commit 161d535
into
mainJan 28, 2026

169 of 172 checks passed

@lucylq
lucylq
deleted the

lfq.check-size-before-memcpy

branch
January 28, 2026 22:10
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

Copilot code reviewCopilot
Copilot review effort, defaults to Lite
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@larryliu0820larryliu0820larryliu0820 approved these changes
@JacobSzwejbkaJacobSzwejbkaAwaiting requested review from JacobSzwejbka
@mergennachinmergennachinAwaiting requested review from mergennachin
@kirklandsignkirklandsignAwaiting requested review from kirklandsignkirklandsign is a code owner

Assignees


No one assigned


Labels

CLA SignedThis label is managed by the Facebook bot. Authors need to sign the CLA before a PR can be reviewed.security-fix

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

4 participants

@lucylq@mergennachin@larryliu0820

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Stack buffer overflow in prepare_input_tensors() due to unchecked memcpy size - #16797
Merged
lucylq merged 1 commit into
mainfrom 
lfq.check-size-before-memcpy
Jan 28, 2026
Merged
Stack buffer overflow in prepare_input_tensors() due to unchecked memcpy size#16797
lucylq merged 1 commit into
mainfrom 
lfq.check-size-before-memcpy
Conversation
@lucylq
@lucylqlucylq
commented
Jan 22, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
Summary
Add size checks for int, double, bool before memcpying. Otherwise the input buffer may be larger than the intended size and overwrite adjacent memory.
Test Plan
(executorch) [lfq@devvm20128.prn0 /data/users/lfq/executorch/build (lfq.check-size-before-memcpy)]$ ctest -R extension_runner_util_test -V
...
54: [ RUN ] InputsTest.DoubleInputWrongSizeFails
54: E 00:00:00.001251 executorch:inputs.cpp:101] Double input at index 2 has size 16, expected sizeof(double) 8
54: [ OK ] InputsTest.DoubleInputWrongSizeFails (0 ms)
...
1/1 Test #54: extension_runner_util_test ....... Passed 0.01 sec
The following tests passed:
extension_runner_util_test
100% tests passed, 0 tests failed out of 1
Total Test time (real) = 0.01 sec

@pytorch-bot
pytorch-botBot
commented
Jan 22, 2026•

edited

Loading

Copy link


Copy Markdown

🔗 Helpful Links
🧪 See artifacts and rendered test results at hud.pytorch.org/pr/pytorch/executorch/16797
Note: Links to docs will display an error until the docs builds have been completed.
❌ 1 New Failure, 8 Pending
As of commit b1dadab with merge base 86b4bea (image):
NEW FAILURE - The following job has failed:
This comment was automatically generated by Dr. CI and updates every 15 minutes.
@meta-clameta-claBot
added
the 
CLA Signed
This label is managed by the Facebook bot. Authors need to sign the CLA before a PR can be reviewed.
label
Jan 22, 2026
@github-actions
github-actionsBot
commented
Jan 22, 2026

Copy link


Copy Markdown

This PR needs a release notes: label
If your change should be included in the release notes (i.e. would users of this library care about this change?), please use a label starting with release notes:. This helps us keep track and include your important work in the next release notes.
To add a label, you can comment to pytorchbot, for example
@pytorchbot label "release notes: none"
For more information, see
https://github.com/pytorch/pytorch/wiki/PyTorch-AutoLabel-Bot#why-categorize-for-release-notes-and-how-does-it-work.
@lucylq
lucylq
marked this pull request as ready for review
January 22, 2026 21:22
CopilotAI
reviewed
Jan 22, 2026
View reviewed changes
CopilotAI
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview
Mitigates a stack buffer overflow risk in prepare_input_tensors() by validating scalar input buffer sizes before copying into stack-allocated variables.
Changes:
  • Add strict size checks for Tag::Int (int64_t), Tag::Double (double), and Tag::Bool (bool) inputs prior to memcpy.
  • Return InvalidArgument with a descriptive error when the provided scalar buffer size is unexpected.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment threadextension/runner_util/inputs.cpp
Outdated

Comment threadextension/runner_util/inputs.cpp
Outdated

@mergennachin
mergennachin
commented
Jan 22, 2026

Copy link


Copy Markdown

Contributor
Can you add a regression test?
@lucylq
lucylqforce-pushed
the
lfq.check-size-before-memcpy
branch
from
b0e5c6d to
8c8d7dcCompareJanuary 23, 2026 00:52
@lucylq
lucylq
requested a review
from CopilotJanuary 23, 2026 00:55
CopilotAI
reviewed
Jan 23, 2026
View reviewed changes
CopilotAI
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview
Copilot reviewed 2 out of 2 changed files in this pull request and generated 7 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment threadextension/runner_util/inputs.cpp
Outdated

Comment threadextension/runner_util/inputs.cpp
Outdated

Comment threadextension/runner_util/test/inputs_test.cpp
Outdated

Comment threadextension/runner_util/test/inputs_test.cpp
Outdated

Comment threadextension/runner_util/test/inputs_test.cpp
Outdated

Comment threadextension/runner_util/test/inputs_test.cpp
Outdated

Comment threadextension/runner_util/inputs.cpp
Outdated

@lucylq
lucylqforce-pushed
the
lfq.check-size-before-memcpy
branch
from
8c8d7dc to
c621f13CompareJanuary 23, 2026 01:13
CopilotAI
review requested due to automatic review settings
January 23, 2026 01:14
@lucylq
lucylqforce-pushed
the
lfq.check-size-before-memcpy
branch
from
c621f13 to
33aa861CompareJanuary 23, 2026 01:14
@lucylq
lucylqforce-pushed
the
lfq.check-size-before-memcpy
branch
from
33aa861 to
8090b55CompareJanuary 23, 2026 01:14
CopilotAI
reviewed
Jan 23, 2026
View reviewed changes
CopilotAI
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment threadextension/runner_util/inputs.cpp
@lucylq
lucylq
commented
Jan 23, 2026

Copy link


Copy Markdown

ContributorAuthor
Can you add a regression test?
@mergennachin added one for double. Feel like that should be OK as it's the same logic, and adding tests for bool/int would need new models to export_program.py that take in bool/int as input. But let me know what you think
larryliu0820
larryliu0820
reviewed
Jan 27, 2026
View reviewed changes
Comment threadextension/runner_util/inputs.cpp
larryliu0820
larryliu0820
approved these changes
Jan 27, 2026
View reviewed changes
@larryliu0820larryliu0820
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Left some non-blocking comments
@lucylq
lucylqforce-pushed
the
lfq.check-size-before-memcpy
branch
from
8090b55 to
801f5a3CompareJanuary 27, 2026 23:01
@lucylq
lucylq
requested a review
from CopilotJanuary 27, 2026 23:04
CopilotAI
reviewed
Jan 27, 2026
View reviewed changes
CopilotAI
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview
Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment threadextension/runner_util/test/CMakeLists.txt
@lucylq
lucylqforce-pushed
the
lfq.check-size-before-memcpy
branch
from
801f5a3 to
e95bc65CompareJanuary 27, 2026 23:23
@lucylq
lucylq
requested a review
from CopilotJanuary 27, 2026 23:24
CopilotAI
reviewed
Jan 27, 2026
View reviewed changes
CopilotAI
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview
Copilot reviewed 6 out of 6 changed files in this pull request and generated 3 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment threadextension/runner_util/test/inputs_test.cpp
Outdated

Comment threadextension/runner_util/test/inputs_test.cpp
Outdated

Comment threadextension/runner_util/test/inputs_test.cpp
@lucylq
lucylqforce-pushed
the
lfq.check-size-before-memcpy
branch
from
e95bc65 to
1f63405CompareJanuary 28, 2026 01:26
CopilotAI
review requested due to automatic review settings
January 28, 2026 01:31
@lucylq
lucylqforce-pushed
the
lfq.check-size-before-memcpy
branch
from
1f63405 to
9c75403CompareJanuary 28, 2026 01:31
CopilotAI
reviewed
Jan 28, 2026
View reviewed changes
CopilotAI
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview
Copilot reviewed 6 out of 6 changed files in this pull request and generated 4 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment threadextension/runner_util/test/inputs_test.cpp
Comment threadextension/runner_util/test/inputs_test.cpp
Outdated

Comment threadextension/runner_util/test/inputs_test.cpp
Comment threadextension/runner_util/test/inputs_test.cpp
@lucylq
lucylqforce-pushed
the
lfq.check-size-before-memcpy
branch
from
9c75403 to
b1dadabCompareJanuary 28, 2026 20:40
@lucylq
lucylq
merged commit 161d535
into
mainJan 28, 2026

169 of 172 checks passed

@lucylq
lucylq
deleted the

lfq.check-size-before-memcpy

branch
January 28, 2026 22:10
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

Copilot code reviewCopilot
Copilot review effort, defaults to Lite
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@larryliu0820larryliu0820larryliu0820 approved these changes
@JacobSzwejbkaJacobSzwejbkaAwaiting requested review from JacobSzwejbka
@mergennachinmergennachinAwaiting requested review from mergennachin
@kirklandsignkirklandsignAwaiting requested review from kirklandsignkirklandsign is a code owner

Assignees


No one assigned


Labels

CLA SignedThis label is managed by the Facebook bot. Authors need to sign the CLA before a PR can be reviewed.security-fix

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

4 participants

@lucylq@mergennachin@larryliu0820

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
Stack buffer overflow in prepare_input_tensors() due to unchecked memcpy size - #16797
Merged
lucylq merged 1 commit into
mainfrom 
lfq.check-size-before-memcpy
Jan 28, 2026
Merged
Stack buffer overflow in prepare_input_tensors() due to unchecked memcpy size#16797
lucylq merged 1 commit into
mainfrom 
lfq.check-size-before-memcpy
Conversation
@lucylq
@lucylqlucylq
commented
Jan 22, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
Summary
Add size checks for int, double, bool before memcpying. Otherwise the input buffer may be larger than the intended size and overwrite adjacent memory.
Test Plan
(executorch) [lfq@devvm20128.prn0 /data/users/lfq/executorch/build (lfq.check-size-before-memcpy)]$ ctest -R extension_runner_util_test -V
...
54: [ RUN ] InputsTest.DoubleInputWrongSizeFails
54: E 00:00:00.001251 executorch:inputs.cpp:101] Double input at index 2 has size 16, expected sizeof(double) 8
54: [ OK ] InputsTest.DoubleInputWrongSizeFails (0 ms)
...
1/1 Test #54: extension_runner_util_test ....... Passed 0.01 sec
The following tests passed:
extension_runner_util_test
100% tests passed, 0 tests failed out of 1
Total Test time (real) = 0.01 sec

@pytorch-bot
pytorch-botBot
commented
Jan 22, 2026•

edited

Loading

Copy link


Copy Markdown

🔗 Helpful Links
🧪 See artifacts and rendered test results at hud.pytorch.org/pr/pytorch/executorch/16797
Note: Links to docs will display an error until the docs builds have been completed.
❌ 1 New Failure, 8 Pending
As of commit b1dadab with merge base 86b4bea (image):
NEW FAILURE - The following job has failed:
This comment was automatically generated by Dr. CI and updates every 15 minutes.
@meta-clameta-claBot
added
the 
CLA Signed
This label is managed by the Facebook bot. Authors need to sign the CLA before a PR can be reviewed.
label
Jan 22, 2026
@github-actions
github-actionsBot
commented
Jan 22, 2026

Copy link


Copy Markdown

This PR needs a release notes: label
If your change should be included in the release notes (i.e. would users of this library care about this change?), please use a label starting with release notes:. This helps us keep track and include your important work in the next release notes.
To add a label, you can comment to pytorchbot, for example
@pytorchbot label "release notes: none"
For more information, see
https://github.com/pytorch/pytorch/wiki/PyTorch-AutoLabel-Bot#why-categorize-for-release-notes-and-how-does-it-work.
@lucylq
lucylq
marked this pull request as ready for review
January 22, 2026 21:22
CopilotAI
reviewed
Jan 22, 2026
View reviewed changes
CopilotAI
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview
Mitigates a stack buffer overflow risk in prepare_input_tensors() by validating scalar input buffer sizes before copying into stack-allocated variables.
Changes:
  • Add strict size checks for Tag::Int (int64_t), Tag::Double (double), and Tag::Bool (bool) inputs prior to memcpy.
  • Return InvalidArgument with a descriptive error when the provided scalar buffer size is unexpected.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment threadextension/runner_util/inputs.cpp
Outdated

Comment threadextension/runner_util/inputs.cpp
Outdated

@mergennachin
mergennachin
commented
Jan 22, 2026

Copy link


Copy Markdown

Contributor
Can you add a regression test?
@lucylq
lucylqforce-pushed
the
lfq.check-size-before-memcpy
branch
from
b0e5c6d to
8c8d7dcCompareJanuary 23, 2026 00:52
@lucylq
lucylq
requested a review
from CopilotJanuary 23, 2026 00:55
CopilotAI
reviewed
Jan 23, 2026
View reviewed changes
CopilotAI
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview
Copilot reviewed 2 out of 2 changed files in this pull request and generated 7 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment threadextension/runner_util/inputs.cpp
Outdated

Comment threadextension/runner_util/inputs.cpp
Outdated

Comment threadextension/runner_util/test/inputs_test.cpp
Outdated

Comment threadextension/runner_util/test/inputs_test.cpp
Outdated

Comment threadextension/runner_util/test/inputs_test.cpp
Outdated

Comment threadextension/runner_util/test/inputs_test.cpp
Outdated

Comment threadextension/runner_util/inputs.cpp
Outdated

@lucylq
lucylqforce-pushed
the
lfq.check-size-before-memcpy
branch
from
8c8d7dc to
c621f13CompareJanuary 23, 2026 01:13
CopilotAI
review requested due to automatic review settings
January 23, 2026 01:14
@lucylq
lucylqforce-pushed
the
lfq.check-size-before-memcpy
branch
from
c621f13 to
33aa861CompareJanuary 23, 2026 01:14
@lucylq
lucylqforce-pushed
the
lfq.check-size-before-memcpy
branch
from
33aa861 to
8090b55CompareJanuary 23, 2026 01:14
CopilotAI
reviewed
Jan 23, 2026
View reviewed changes
CopilotAI
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment threadextension/runner_util/inputs.cpp
@lucylq
lucylq
commented
Jan 23, 2026

Copy link


Copy Markdown

ContributorAuthor
Can you add a regression test?
@mergennachin added one for double. Feel like that should be OK as it's the same logic, and adding tests for bool/int would need new models to export_program.py that take in bool/int as input. But let me know what you think
larryliu0820
larryliu0820
reviewed
Jan 27, 2026
View reviewed changes
Comment threadextension/runner_util/inputs.cpp
larryliu0820
larryliu0820
approved these changes
Jan 27, 2026
View reviewed changes
@larryliu0820larryliu0820
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Left some non-blocking comments
@lucylq
lucylqforce-pushed
the
lfq.check-size-before-memcpy
branch
from
8090b55 to
801f5a3CompareJanuary 27, 2026 23:01
@lucylq
lucylq
requested a review
from CopilotJanuary 27, 2026 23:04
CopilotAI
reviewed
Jan 27, 2026
View reviewed changes
CopilotAI
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview
Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment threadextension/runner_util/test/CMakeLists.txt
@lucylq
lucylqforce-pushed
the
lfq.check-size-before-memcpy
branch
from
801f5a3 to
e95bc65CompareJanuary 27, 2026 23:23
@lucylq
lucylq
requested a review
from CopilotJanuary 27, 2026 23:24
CopilotAI
reviewed
Jan 27, 2026
View reviewed changes
CopilotAI
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview
Copilot reviewed 6 out of 6 changed files in this pull request and generated 3 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment threadextension/runner_util/test/inputs_test.cpp
Outdated

Comment threadextension/runner_util/test/inputs_test.cpp
Outdated

Comment threadextension/runner_util/test/inputs_test.cpp
@lucylq
lucylqforce-pushed
the
lfq.check-size-before-memcpy
branch
from
e95bc65 to
1f63405CompareJanuary 28, 2026 01:26
CopilotAI
review requested due to automatic review settings
January 28, 2026 01:31
@lucylq
lucylqforce-pushed
the
lfq.check-size-before-memcpy
branch
from
1f63405 to
9c75403CompareJanuary 28, 2026 01:31
CopilotAI
reviewed
Jan 28, 2026
View reviewed changes
CopilotAI
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview
Copilot reviewed 6 out of 6 changed files in this pull request and generated 4 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment threadextension/runner_util/test/inputs_test.cpp
Comment threadextension/runner_util/test/inputs_test.cpp
Outdated

Comment threadextension/runner_util/test/inputs_test.cpp
Comment threadextension/runner_util/test/inputs_test.cpp
@lucylq
lucylqforce-pushed
the
lfq.check-size-before-memcpy
branch
from
9c75403 to
b1dadabCompareJanuary 28, 2026 20:40
@lucylq
lucylq
merged commit 161d535
into
mainJan 28, 2026

169 of 172 checks passed

@lucylq
lucylq
deleted the

lfq.check-size-before-memcpy

branch
January 28, 2026 22:10
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

Copilot code reviewCopilot
Copilot review effort, defaults to Lite
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@larryliu0820larryliu0820larryliu0820 approved these changes
@JacobSzwejbkaJacobSzwejbkaAwaiting requested review from JacobSzwejbka
@mergennachinmergennachinAwaiting requested review from mergennachin
@kirklandsignkirklandsignAwaiting requested review from kirklandsignkirklandsign is a code owner

Assignees


No one assigned


Labels

CLA SignedThis label is managed by the Facebook bot. Authors need to sign the CLA before a PR can be reviewed.security-fix

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

4 participants

@lucylq@mergennachin@larryliu0820