← Back to events
ActiveAIRelease

ciflow/trunk/194112: Fix integer overflow in max_pool1d shape checks

What happened

torch.max_pool1d segfaults for several out-of-domain integer arguments. Two overflows in the shape math remain after the at::divup fix this is stacked on: div_rtn() computed the floor quotient in int regardless of T , although every call site passes div_rtn . The truncated remainder gets the wrong sign, so the floor correction is skipped and the quotient wraps: for #73190 the true output size -2147483694 became +214…

Summary assembled by rule from the sources below

Why it's spreading

Sources