-
Notifications
You must be signed in to change notification settings - Fork 659
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
double free bug in init_index #467
Comments
Hi @D4rkD0g, |
Appears that this issue got CVE-2023-37365 assigned. |
emollier
added a commit
to emollier/hnswlib
that referenced
this issue
Jul 18, 2023
This patch works around issue nmslib#467, also referenced as CVE-2023-37365, by implementing Yury Malkov's suggestion about capping the M value, coding the maximum number of outgoing connections in the graph, to a reasonable enough value of the order of 100000. For the record, the documentation indicates reasonable values for M range from 2 to 100, which are well within the cap; see ALGO_PARAMS.md. The reproducer shown in issue nmslib#467 doesn't trigger the double free condition anymore after this change is applied, but completes successfully, although with the below warning popping up on purpose: warning: M parameter exceeds 100000 which may lead to adverse effects. Cap to 100000 will be applied for the rest of the processing. Signed-off-by: Étienne Mollier <[email protected]>
Hello, did this fix make it into a release yet? Some vulnerability scanners e.g. https://security.snyk.io/vuln/SNYK-PYTHON-HNSWLIB-5750284 are still flagging the package as vulnerable. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Hi, the hnswlib will crashed when init index if the parameter if too big
the backtrace
The text was updated successfully, but these errors were encountered: