Skip to content

fix: add negative index bounds check in ArrayObj #376

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
junrushao merged 2 commits into from
Jan 2, 2026
Merged

fix: add negative index bounds check in ArrayObj #376

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
218e57b
fix: add negative index bounds check in ArrayObj
guan404ming Jan 2, 2026
de9644a
Update test
guan404ming Jan 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions include/tvm/ffi/container/array.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -70,7 +70,7 @@ class ArrayObj : public Object, public details::InplaceArrayBase<ArrayObj, TVMFF
* \return the i-th element.
*/
const Any& operator[](int64_t i) const {
if (i >= size_) {
if (i < 0 || i >= size_) {
TVM_FFI_THROW(IndexError) << "Index " << i << " out of bounds " << size_;
}
return static_cast<Any*>(data_)[i];
Expand All @@ -91,7 +91,7 @@ class ArrayObj : public Object, public details::InplaceArrayBase<ArrayObj, TVMFF
* \param item The value to be set
*/
void SetItem(int64_t i, Any item) {
if (i >= size_) {
if (i < 0 || i >= size_) {
TVM_FFI_THROW(IndexError) << "Index " << i << " out of bounds " << size_;
}
static_cast<Any*>(data_)[i] = std::move(item);
Expand Down
31 changes: 31 additions & 0 deletions tests/cpp/test_array.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -312,4 +312,35 @@ TEST(Array, Contains) {
EXPECT_FALSE(f(str_arr, String("foo")).cast<bool>());
}

TEST(Array, NegativeIndexThrows) {
Array<int> arr = {1, 2, 3};
// Directly test ArrayObj methods, which are the ones modified in this PR.
// The Array<T> wrapper methods already had negative index checks.
ArrayObj* arr_obj = arr.GetArrayObj();

// Test ArrayObj::at (which calls operator[])
EXPECT_THROW(
{
try {
[[maybe_unused]] const auto& val = arr_obj->at(-1);
} catch (const Error& error) {
EXPECT_EQ(error.kind(), "IndexError");
throw;
}
},
::tvm::ffi::Error);

// Test ArrayObj::SetItem
EXPECT_THROW(
{
try {
arr_obj->SetItem(-1, Any(42));
} catch (const Error& error) {
EXPECT_EQ(error.kind(), "IndexError");
throw;
}
},
::tvm::ffi::Error);
}

} // namespace