es-ude / es-ude/OnDeviceTraining
Pool kernels (FLOAT32/SYM arms) validate only the output length — lift poolBfpRequireDims3 into the shared arms
- Dominant language
- C
- Stars
- 1
- Forks
- 3
- Avg merge
- 1d 1h
- Merged PRs (30d)
- 8
Description
Pre-existing gap surfaced by the BFP epic PR4 plan review (F5) and deliberately NOT fixed inside PR4 (an unrelated behavior change in the FLOAT32/SYM arms does not belong in a BFP PR).
`avgPool1dForwardKernelSymInt32`, `avgPool1dBackwardKernelSymInt32`, the AdaptiveAvgPool1d and MaxPool1d SYM kernels, and the FLOAT32 arms of all three pool layers check the output LENGTH against the geometry but never the batch or channel dims (nor the rank), while indexing `(b * channels + c) * outputLength + outPos` with batch/channels taken from the INPUT. A mismatched batch or channel count writes past the end of the output buffer; a rank-2 operand over-reads the dims array itself.
**Fix model:** lift PR4's `poolBfpRequireDims3` (see `src/layer/AvgPool1d.c` on the PR4 branch) into the shared arms — full shape+rank validation, both operands, forward and backward. PR4's BFP kernels are already hardened exactly this way (incl. the operand-side rank gates from the wave-2 review); mirror their guard placement and death-test shape. Note from PR4 wave-2: a deleted operand-rank guard is not mutation-killable when a same-exit-code shape gate sits right behind it — prove reachability with a distinct-exit-code probe instead (see the in-comment discipline in `test/unit/layer/UnitTestAvgPool1d.c` `testAvgPool1dBfpRejectsRank2Operands`).
Blocked on: epic PR4 merge (the model code lives on that branch).
🤖 Generated with [Claude Code](https://claude.com/claude-code)
https://claude.ai/code/session_01UzyrYp4e8J2tRjAbkhtnwo
Contributor guide
Research direction
After the BFP epic PR4 merges, read src/layer/AvgPool1d.c and compare the shared FLOAT32/SYM arms with the hardened BFP kernels, including poolBfpRequireDims3. Run the pool unit tests in test/unit/layer/UnitTestAvgPool1d.c, especially testAvgPool1dBfpRejectsRank2Operands; done means forward and backward pool kernels reject invalid rank, batch, channel, and length shapes with reachable death tests.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- embedded-iot, machine-learning, testing-qa
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 52/100