From 031c35c6963c3fa674be53f06f420db0d9407c03 Mon Sep 17 00:00:00 2001 From: Fredrik Ekre Date: Fri, 19 Apr 2019 09:36:23 +0200 Subject: [PATCH] fix #31758: out of bounds write in sparse broadcast (#31763) (cherry picked from commit c0c6f96b78b057a0c7e8360a1f6df9c4be2a900b) --- stdlib/SparseArrays/src/higherorderfns.jl | 2 +- stdlib/SparseArrays/test/higherorderfns.jl | 10 ++++++++++ 2 files changed, 11 insertions(+), 1 deletion(-) diff --git a/stdlib/SparseArrays/src/higherorderfns.jl b/stdlib/SparseArrays/src/higherorderfns.jl index e09ca104c42208..68c267f1848dce 100644 --- a/stdlib/SparseArrays/src/higherorderfns.jl +++ b/stdlib/SparseArrays/src/higherorderfns.jl @@ -383,7 +383,7 @@ function _map_zeropres!(f::Tf, C::SparseVecOrMat, As::Vararg{SparseVecOrMat,N}) vals, ks, rows = _fusedupdate_all(rowsentinel, activerow, rows, ks, stopks, As) Cx = f(vals...) if !_iszero(Cx) - Ck > spaceC && (spaceC = expandstorage!(C, Ck + min(length(C), _sumnnzs(As...)) - (sum(ks) - N))) + Ck > spaceC && (spaceC = expandstorage!(C, min(length(C), Ck + _sumnnzs(As...) - (sum(ks) - N)))) storedinds(C)[Ck] = activerow storedvals(C)[Ck] = Cx Ck += 1 diff --git a/stdlib/SparseArrays/test/higherorderfns.jl b/stdlib/SparseArrays/test/higherorderfns.jl index 5871e2d96e1e23..2e1f1b6013771c 100644 --- a/stdlib/SparseArrays/test/higherorderfns.jl +++ b/stdlib/SparseArrays/test/higherorderfns.jl @@ -632,4 +632,14 @@ end @test minimum(sparse([1, 2], [1, 2], ones(Int32, 2)), dims = 1) isa Matrix end +@testset "issue #31758: out of bounds write in _map_zeropres!" begin + y = sparsevec([2,7], [1., 2.], 10) + x1 = sparsevec(fill(1.0, 10)) + x2 = sparsevec([2,7], [1., 2.], 10) + x3 = sparsevec(fill(1.0, 10)) + f(x, y, z) = x == y == z == 0 ? 0.0 : NaN + y .= f.(x1, x2, x3) + @test all(isnan, y) +end + end # module