A potential Integer Overflow bug found in liblinear/linear.cpp about liblinear HOT 4 CLOSED

Hi, I read your problem and would like to ask why you said the parameter of Malloc is more easily to overflow when nr_class is equal to 2? Is there a simple narrative to explain?
Also, in previous issue #88, did you actually encounter the scenario where you have model->nr_feature greater than 2^16-1 thus causes overflow? or is it just a potential scenario?

from liblinear.

Well, it seems a mistake in my expression. I was just want to say that nr_class=2 is more easily to cause an integer overflow than nr_class=1. Of course, nr_class can be a much higher value (than 2) and assigned to nr_w to cause an integer overflow much more easily, but I am not familiar with the restriction of the source of nr_class, so I didn't make that further statement.

yes, it is just a potential scenario reported by static analyzer, I tried to figure out how to actually trigger this bug but failed.

from liblinear.

Well, if you look closely at the if-else statement, nr_w is assigned to value 1 when nr_class is either equal to 1 or 2, so I think both cases have the same chance to occur overflow. Also, nr_class and nr_w are of type int, I assume overflowing in typical machine isn't a main concern, but if you really have a large set of data, @cjlin1 did mention a version that can handle larger set of data in #88. I guess this solution might solve your problem.

Same solution for #88

from liblinear.

At this moment we do not cover data with more than 2^32 features/labels. If you need to handle such large data, please use "LIBLINEAR for more than 2^32 instances/features (experimental)" at https://www.csie.ntu.edu.tw/~cjlin/libsvmtools/#liblinear_for_more_than_2^32_instances_features_experimental

So we don't plan to do any change here. Thank you again for your comments.

from liblinear.