Skip to content

Fix potential bad memory access at polyroots function #1532

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
MiraiHattori wants to merge 7 commits into
base: production
Choose a base branch
from
+18 −5
Open

Fix potential bad memory access at polyroots function #1532

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
048eab0
fix potential out-of-bound memory access in quintic smoother
MiraiHattori Sep 24, 2025
4a71342
fix more places with polyroots dReal, 1 templates
MiraiHattori Sep 24, 2025
8230e65
add -Werror=array-bounds to gcc/clang options
MiraiHattori Sep 24, 2025
6d6b8a5
fix wrong index specified in one of the recent commits
MiraiHattori Sep 24, 2025
f8e60e4
bumped minor version due to header changes. added changelog
MiraiHattori Sep 24, 2025
34f3cc7
Revert "add -Werror=array-bounds to gcc/clang options"
MiraiHattori Sep 24, 2025
dcd085a
set the version bump back to patch.
MiraiHattori Sep 25, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 6 additions & 2 deletions include/openrave/mathextra.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1219,6 +1219,8 @@ template <typename IKReal, int D>
inline void polyroots(const IKReal* rawcoeffs, IKReal* rawroots, int& numroots)
{
using std::complex;
static_assert(D > 1, "D should be greater than 1. Solve linear equation to handle D==1 case"); // this function accesses roots[1]

BOOST_ASSERT(rawcoeffs[0] != 0);
const IKReal tol = 128.0*std::numeric_limits<IKReal>::epsilon();
const IKReal tolsqrt = sqrt(std::numeric_limits<IKReal>::epsilon());
Expand Down Expand Up @@ -1466,7 +1468,9 @@ inline bool computequinticnextdiscretizedstep(const T* coeffs, const T step, con
polyroots<T, 2>(&tempcoeffs[3], rawroots, numroots);
}
else if( tempcoeffs[4] != 0 ) {
polyroots<T, 1>(&tempcoeffs[4], rawroots, numroots);
// polyroots<T, 1>(&tempcoeffs[4], rawroots, numroots); // out-of-bound memory access
numroots = 1;
rawroots[0] = -tempcoeffs[4]/tempcoeffs[3];
}
bool bFound = false;
for( int i = 0; i < numroots; ++i ) {
Expand Down Expand Up @@ -1512,7 +1516,7 @@ inline bool computecubicnextdiscretizedstep(const T* coeffs, const T step, const
polyroots<T, 2>(&tempcoeffs[1], rawroots, numroots);
}
else if( tempcoeffs[2] != 0 ) {
// polyroots<T, 1>(&tempcoeffs[2], rawroots, numroots);
// polyroots<T, 1>(&tempcoeffs[2], rawroots, numroots); // out-of-bound memory access
numroots = 1;
rawroots[0] = -tempcoeffs[3]/tempcoeffs[2];
}
Expand Down
8 changes: 6 additions & 2 deletions src/libopenrave/planningutils.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4166,7 +4166,9 @@ int DynamicsCollisionConstraint::Check(const std::vector<dReal>& q0, const std::
mathextra::polyroots<dReal, 2>(&_vrawcoeffs[1], &_vrawroots[0], numroots);
}
else if( _vrawcoeffs[2] != 0 ) {
mathextra::polyroots<dReal, 1>(&_vrawcoeffs[2], &_vrawroots[0], numroots);
// mathextra::polyroots<dReal, 1>(&_vrawcoeffs[2], &_vrawroots[0], numroots); // out-of-bound memory access
numroots = 1;
_vrawroots[0] = -_vrawcoeffs[3]/_vrawcoeffs[2];
}
break;
case IT_Quintic:
Expand All @@ -4186,7 +4188,9 @@ int DynamicsCollisionConstraint::Check(const std::vector<dReal>& q0, const std::
mathextra::polyroots<dReal, 2>(&_vrawcoeffs[3], &_vrawroots[0], numroots);
}
else if( _vrawcoeffs[4] != 0 ) {
mathextra::polyroots<dReal, 1>(&_vrawcoeffs[4], &_vrawroots[0], numroots);
// mathextra::polyroots<dReal, 1>(&_vrawcoeffs[4], &_vrawroots[0], numroots); // out-of-bound memory access
numroots = 1;
_vrawroots[0] = -_vrawcoeffs[5]/_vrawcoeffs[4];
}
break;
default:
Expand Down