Skip to content

[BUG] There is no overflow checking on alignment #1156

@revans2

Description

@revans2

Describe the bug
I know it feels a bit far fetched that anyone would ask to allocate 18446744073709551612 bytes (about 16 exa-bytes). But if someone does the allocation will succeed and return nullptr as the result. The reason for this is because there is no overflow checking in align_up, and align_up is called for all device allocations
, so when it is aligned up and overflows the size becomes 0 bytes, which succeeds.

The problem really starts to show up when using CUDF with RMM. CUDF uses an int32_t for a lot of size calculations. Because it is signed it can overflow to a negative number, and when it does it gets translated into a really large positive number. The example came from CUDF when it overflowed and tried to allocate -4 bytes when doing a string concatenation. This resulted in the call succeeding and an error happening after the fact when we tried to use the result some other place and an assertion went off about having a negative sized length in one of the columns.

Steps/Code to reproduce bug
Try to allocate a buffer of 18446744073709551612 bytes. It will succeed.

Expected behavior
Some kind of an exception preferably a std::bad_alloc is thrown.

Metadata

Metadata

Assignees

Labels

? - Needs TriageNeed team to review and classifybugSomething isn't working

Type

No type

Projects

Status

Done

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions