This bugzilla service is closed. All entries have been migrated to https://gitlab.com/libeigen/eigen
Bug 1466 - Dereferencing a null pointer for zero sized matrices
Summary: Dereferencing a null pointer for zero sized matrices
Status: CONFIRMED
Alias: None
Product: Eigen
Classification: Unclassified
Component: Core - matrix products (show other bugs)
Version: 3.3 (current stable)
Hardware: x86 - 64-bit Linux
: Normal Unknown
Assignee: Nobody
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2017-09-14 16:17 UTC by Mmanu Chaturvedi
Modified: 2019-12-04 17:11 UTC (History)
2 users (show)



Attachments

Description Mmanu Chaturvedi 2017-09-14 16:17:46 UTC
If my assumption that Eigen allows multiplying zero sized matrices on purpose is correct, then there is a dereferencing of null pointer happening which seems benign to start with, but I'm not sure if it always so because the function getVectorMapper causing the trouble is used at other places as well.

To reproduce, here's the code (to be run with UBSan) : 
https://gist.github.com/m-chaturvedi/5eb211e43b55943d3e86f7f13cd429b3

I say benign because all the usages of lhs0 variable which is calling the function dereferencing a null pointer (BlasUtil.h:218 via BlasUtil.h:211 in version 3.3.3) are conditional and never run for zero sized matrices: 

https://bitbucket.org/m-chaturvedi/eigen/src/67e894c6cd8f5f1f604b27d37ed47fdf012674ff/Eigen/src/Core/products/GeneralMatrixVector.h?at=3.3.3&fileviewer=file-view-default#GeneralMatrixVector.h-582

I observed that the bug is not reproducible with the current default, perhaps because GeneralMatrixVector.h was totally revamped, but is reproducible with 3.3.4.
Comment 1 Christoph Hertzberg 2017-09-14 17:42:19 UTC
I can confirm this. In the devel branch it has been fixed within this commit (and the following "fix" commit):
https://bitbucket.org/eigen/eigen/commits/21acc0e8d782
Comment 2 Nobody 2019-12-04 17:11:23 UTC
-- GitLab Migration Automatic Message --

This bug has been migrated to gitlab.com's GitLab instance and has been closed from further activity.

You can subscribe and participate further through the new bug through this link to our GitLab instance: https://gitlab.com/libeigen/eigen/issues/1466.

Note You need to log in before you can comment on or make changes to this bug.