Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
paddlepaddle/fastdeploy
develop @ e8ae0f9
37
Fixes
1
CVEs
HIGH
Peak severity
33.3%
Coverage
Highlights
Denial of Service: 31 prior fixes. Scrutinize any change in this area.
fastdeploy/engine/sched/resource_manager_v1.py: most-fixed (4 issues). Treat as high-risk during review.
18 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Path Traversal: Tarball extraction using tarfile.extractall is highly vulnerable to Path Traversal if the archive contains malicious member paths. Attackers could overwrite arbitrary files or inject backdoors. The fix implements strict path canonicalization and prefix verification to prevent extraction outside the intended directory.
Integer Overflow: Using 32-bit integers to calculate the size of tensor allocations is a classic vector for integer overflows, potentially resulting in undersized allocations followed by out-of-bounds writes. Upgrading the underlying types to 64-bit integers mitigates this calculation hazard.
Out-of-bounds Read: Incorrect pointer stride and offset calculations in GPU custom kernels can lead to out-of-bounds reads and memory safety violations. This was solved by correcting the arithmetic of raw pointer offsets for stop sequences.