Skip to content

cudf::tile silently wraps output row count past INT32_MAX rows #23830

Description

@VaggelisGian

cudf::tile computes its output row count with 32-bit signed multiplication (auto out_num_rows = in_num_rows * count; at cpp/src/reshape/tile.cu:44) and has no product guard, so any request whose true output exceeds INT32_MAX rows silently wraps.

Two observed failure modes against libcudf 26.10 nightly (RTX 5060 Ti):

  • tile(3-row int8 table, count = INT32_MAX): the product 6442450941 wraps to +2147483645; the call returns normally with a table of 2147483645 rows, violating the documented contract output.num_rows() == input.num_rows() * count (include/cudf/reshape.hpp). Silent wrong answer.
  • tile(2-row int8 table, count = INT32_MAX): the product wraps to -2; the call surfaces as rmm::out_of_memory trying to allocate 18446744073709551614 bytes instead of a clean overflow message.

The sibling API with the same shape already has the repo-standard guard (cpp/src/filling/repeat.cu, also strings/repeat_strings.cu):

CUDF_EXPECTS(input_table.num_rows() <= std::numeric_limits<size_type>::max() / count,
             "The resulting table exceeds the column size limit",
             std::overflow_error);

Suggested fix: add the same CUDF_EXPECTS after the zero-row early return in tile (there count > 0 and in_num_rows > 0 are guaranteed, so no division-by-zero concern).

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

bugSomething isn't workinglibcudfAffects libcudf (C++/CUDA) code.

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions