CVE-2026-3920
Overview
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifruy/pack_avx2_fma.cc |
modified |
Files Changed
ruy/mat.hruy/pack_avx2_fma.cc
Patch
From c74e83f433f56aa88465486c5be185369142e61e Mon Sep 17 00:00:00 2001
From: Reilly Grant <reillyg@google.com>
Date: Wed, 25 Feb 2026 00:18:33 +0000
Subject: [PATCH] [M-146] Use std::ptrdiff_t for matrix dimensions and indices.
(Cherry-picked from 8a21714c60bdf0aa95405404e7322e455a34de72.)
PiperOrigin-RevId: 868743667
Bug: 482875307
Change-Id: I9de8e25ff4d22ff99bd63ad1573cfcc8d2aba990
---
diff --git a/ruy/mat.h b/ruy/mat.h
index c2254f9..520d717 100644
--- a/ruy/mat.h
+++ b/ruy/mat.h
@@ -328,7 +328,7 @@
}
inline std::ptrdiff_t FlatSize(const MatLayout& layout) {
- const int outerdim =
+ const std::ptrdiff_t outerdim =
layout.order == Order::kColMajor ? layout.cols : layout.rows;
return layout.stride * outerdim;
}
diff --git a/ruy/pack_avx2_fma.cc b/ruy/pack_avx2_fma.cc
index 2564b72..116854b 100644
--- a/ruy/pack_avx2_fma.cc
+++ b/ruy/pack_avx2_fma.cc
@@ -13,6 +13,7 @@
limitations under the License.
==============================================================================*/
+#include <cstddef>
#include <cstdint>
#include <cstring>
@@ -595,9 +596,9 @@
src_ptr, zerobuf, src_stride, remaining_src_cols, src_rows, packed_ptr,
trailing_buf);
- const int trailing_rows = src_rows & (kPackRows - 1);
+ const std::ptrdiff_t trailing_rows = src_rows & (kPackRows - 1);
if (trailing_rows > 0) {
- const int non_trailing_rows = src_rows & ~(kPackRows - 1);
+ const std::ptrdiff_t non_trailing_rows = src_rows & ~(kPackRows - 1);
memcpy(packed_ptr + kPackCols * non_trailing_rows, trailing_buf,
kPackCols * trailing_rows * sizeof(float));
}
Original Bug Report
webnn_graph_mojolpm_fuzzer: Segv on unknown address in ruy::MulFrontEndFromTrMulParams
Detailed Report: https://clusterfuzz.com/testcase?key=5384407544168448
Fuzzing Engine: libFuzzer Fuzz Target: webnn_graph_mojolpm_fuzzer Job Type: mac_libfuzzer_chrome_asan Platform Id: mac
Crash Type: Segv on unknown address Crash Address: Crash State: ruy::MulFrontEndFromTrMulParams void ruy::MulFrontEnd< tflite::cpu_backend_gemm::detail::GemmImplUsingRuy<float, float, float, float,
Sanitizer: address (ASAN)
Regressed: https://clusterfuzz.com/revisions?job=mac_libfuzzer_chrome_asan&range=1468407:1468456
Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5384407544168448
Issue filed automatically.
See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for instructions on reproducing this bug locally.