fix(hnswalg): reject loadIndex when max_elements_ < cur_element_count - #677
Open
chakshu-dhannawat wants to merge 1 commit into
Open
chakshu-dhannawat wants to merge 1 commit into
chakshu-dhannawat wants to merge 1 commit into
Conversation
ilyajob05
added a commit
that referenced
this pull request
Sep 13, 2026
getDataByLabelNoExceptions: construct the vector from [ptr, ptr+dim) instead of a push_back loop (#679). loadIndexNoExceptions: if the file's max_elements_ is smaller than cur_element_count, return Status instead of allocating a short buffer (#677, adapted from throw to Status for the no-exceptions API). Co-authored-by: ronak singh <singhronak2008@gmail.com> Co-authored-by: Chakshu Dhannawat <chakshu.dhannawat1@gmail.com>
ilyajob05
added a commit
to ilyajob05/hnswlib
that referenced
this pull request
Sep 14, 2026
getDataByLabelNoExceptions: construct the vector from [ptr, ptr+dim) instead of a push_back loop (nmslib#679). loadIndexNoExceptions: if the file's max_elements_ is smaller than cur_element_count, return Status instead of allocating a short buffer (nmslib#677, adapted from throw to Status for the no-exceptions API). Co-authored-by: ronak singh <singhronak2008@gmail.com> Co-authored-by: Chakshu Dhannawat <chakshu.dhannawat1@gmail.com>
chakshu-dhannawat
force-pushed
the
fix/loadindex-max-elements-bound-check
branch
from
September 24, 2026 00:31
529810b to
b3f1fcc
Compare
chakshu-dhannawat
force-pushed
the
fix/loadindex-max-elements-bound-check
branch
from
September 24, 2026 01:39
b3f1fcc to
280cb59
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #673
loadIndexsized the level-0 allocation from the file'smax_elements_field but then readcur_element_count * size_data_per_element_bytes. A crafted index withmax_elements_ < cur_element_counttherefore caused a heap-buffer-overflow write.Add a bound check right after
max_elements_is finalized so malformed indexes throwIndex seems to be corrupted or unsupportedinstead of overflowing.Added
tests/python/bindings_test_loadindex_corruption.pywith two tests: one that crafts a malformed 2-element index withmax_elements_=1and asserts loading raisesRuntimeError, and one that verifies a normal saved index still loads and self-searches correctly.All Python binding tests pass (16/16).