deepseek-ai / deepseek-ai/DeepGEMM

get_env<int> returns uninitialized data for malformed values

Open
#412 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Cuda
Stars
7.8k
Forks
1.3k
Avg merge
3d 7h
Merged PRs (30d)
3

Description

## Summary

`get_env` ignores the return value of `std::sscanf` and returns an uninitialized local when an environment variable is set to a non-numeric value:

```cpp
int value;
std::sscanf(c_str, "%d", &value);
return value;
```

If parsing fails, `value` is never initialized and reading it is undefined behavior. The unset case is safe because it returns the configured default before reaching this branch.

## Impact

The helper is used by more than twenty C++ configuration reads. Most are debug flags, where malformed values can unexpectedly enable logging. `DG_JIT_CPP_STANDARD` is more consequential: a plausible value such as `c++17` fails `%d` parsing and can put an indeterminate standard number into the JIT compiler command.

The same parser bug was independently reported in deepseek-ai/DeepEP#733.

## Expected behavior

Integer environment variables should be parsed deterministically. Malformed, partially parsed, and out-of-range values should fail clearly instead of returning uninitialized or truncated data.

## Proposed fix

Use a full-consumption, range-checked integer parser and cover it with a host-only C++ regression test. The test should require no CUDA toolkit or GPU and should cover valid signs/whitespace/bounds plus empty, boolean, hex-like, trailing-junk, and overflow inputs.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.