Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

PAPI_event_code_to_name potential memory risk #8

Open
anustuvicl opened this issue Apr 15, 2023 · 0 comments
Open

PAPI_event_code_to_name potential memory risk #8

anustuvicl opened this issue Apr 15, 2023 · 0 comments
Assignees
Labels
type-bug Issues discussing bugs or PRs fixing bugs

Comments

@anustuvicl
Copy link
Contributor

anustuvicl commented Apr 15, 2023

For native events PAPI_event_code_to_name(int EventCode, char *out) calls _papi_hwi_native_code_to_name( EventCode, out, PAPI_MAX_STR_LEN). Thus, it assumes that the event name could be max 128 characters. There are several potential problems with this,

  • CUDA Perfworks has event names that can go up to 133 characters, thus calling this function returns PAPI_ENOMEM which is not documented behavior. These long cuda events are all multipass (and cannot be measured) but PAPI event name<->code API should work for them too.
  • If the user has a string defined as char evt_name[64] and calls PAPI_event_code_to_name(EventCode, evt_name) then it's a buffer overflow. The example in docs shows char EventCodeStr[PAPI_MAX_STR_LEN] but this is not mentioned as a requirement.

PAPI API needs to account for possibly longer event names, and properly truncate at user string length. The function should be defined as PAPI_event_code_to_name(int EventCode, char *out, int len).

Alternatively, we can have a function that returns a pointer to a dynamically allocated string that the user needs to free.

@anustuvicl anustuvicl self-assigned this Apr 15, 2023
@anustuvicl anustuvicl added the type-bug Issues discussing bugs or PRs fixing bugs label Apr 15, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
type-bug Issues discussing bugs or PRs fixing bugs
Projects
None yet
Development

No branches or pull requests

1 participant