Commit 6a3a0f4
committed
hnswalg.h: cap M to 100000
This patch works around issue #467, also referenced as CVE-2023-37365,
by implementing Yury Malkov's suggestion about capping the M value,
coding the maximum number of outgoing connections in the graph, to a
reasonable enough value of the order of 100000. For the record, the
documentation indicates reasonable values for M range from 2 to 100,
which are well within the cap; see ALGO_PARAMS.md.
The reproducer shown in issue #467 doesn't trigger the double free
condition anymore after this change is applied, but completes
successfully, although with the below warning popping up on purpose:
warning: M parameter exceeds 100000 which may lead to adverse effects.
Cap to 100000 will be applied for the rest of the processing.
Signed-off-by: Étienne Mollier <emollier@debian.org>1 parent 359b2ba commit 6a3a0f4
1 file changed
+7
-1
lines changed| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
101 | 101 | | |
102 | 102 | | |
103 | 103 | | |
104 | | - | |
| 104 | + | |
| 105 | + | |
| 106 | + | |
| 107 | + | |
| 108 | + | |
| 109 | + | |
| 110 | + | |
105 | 111 | | |
106 | 112 | | |
107 | 113 | | |
| |||
0 commit comments