Out-of-bounds access in CVODE when vector of absolute tolerances has the wrong shape
Nobody has claimed this yet.
- Dominant language
- C
- Stars
- 686
- Forks
- 167
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 17
Description
`CVodeSVtolerances` allows to specify state-specific absolute tolerances with a vector. However, it does not check that the vector passed to the function actually has the correct length. When the vector has too few entries, it will simply access memory that does not belong to the vector.
This leads to really strange behavior that is very hard to debug because the solver sometimes fails to converge and sometimes does not with the same code (depending on what numbers coincidentally are in the memory section following the vector).
Maybe aborting in `NVector`-operations when shapes mismatch would also make it easier to debug issues like this.
Tested with SUNDIALS version 5.8.0, but as far as I see the problem should still exist in 6.0.0.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at the CVodeSVtolerances entry point and inspect how the absolute-tolerance vector is consumed, along with the existing CVODE and NVector tests. Reproduce the wrong-length-vector case, then add coverage showing that mismatched shapes are handled safely rather than accessed out of bounds.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100