Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
dmlc/xgboost
master @ b4fdd9f
4
Fixes
0
CVEs
HIGH
Peak severity
Highlights
Out-of-bounds Write: 2 prior fixes. Scrutinize any change in this area.
R-package/src/xgboost_R.cpp: most-fixed (1 issue). Treat as high-risk during review.
4 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Out-of-bounds Write: Evaluating test data with more features than the trained model can lead to out-of-bounds memory writes on model vectors. Developers must strictly enforce bounds checks when mapping feature indices to model data structures during evaluation.
Memory Safety: Passing unaligned NumPy or SciPy CSR arrays to the C++ backend can trigger undefined behavior and memory corruption. The Python data-parsing layer must ensure all input pointers and array allocations are properly aligned prior to C++ processing.
Integer Overflow: Signed integer overflows during matrix dimension calculations can result in undersized vector allocations, leading to heap-based buffer overflows. Safe integer casting is required prior to memory allocation.