The following issues were found

torch/csrc/jit/mobile/train/optim/sgd.cpp
1 issues
equal - Function does not check the second iterator for over-read conditions
Security

Line: 50 Column: 17 CWE codes: 126
Suggestion: This function is often discouraged by most C++ coding standards in favor of its safer alternatives provided since C++14. Consider using a form of this function that checks the second iterator before potentially overflowing it

              }

bool operator==(const SGDParamState& lhs, const SGDParamState& rhs) {
  return torch::equal(lhs.momentum_buffer(), rhs.momentum_buffer());
}

void SGD::add_param_group(const SGDParamGroup& param_group) {
  for (const auto& param : param_group.params()) {
    TORCH_CHECK(param.is_leaf(), "can't optimize a non-leaf Tensor");

            

Reported by FlawFinder.

torch/ao/nn/__init__.py
1 issues
Missing module docstring
Error

Line: 1 Column: 1

              from torch.ao.nn import sparse

            

Reported by Pylint.

torch/csrc/jit/mobile/import.cpp
1 issues
setstate - This function is not sufficiently random for security-related functions such as key and nonce creation
Security

Line: 157 Column: 7 CWE codes: 327
Suggestion: Use a more secure technique for acquiring random values

                  }
    return nullptr;
  };
  if (setstate) {
    auto obj = c10::ivalue::Object::create(type, 0);
    Stack stack({obj, input});
    setstate->run(stack);
    return obj;
  } else if (auto custom_class_type = find_custom_class_with_setstate()) {

            

Reported by FlawFinder.

torch/csrc/api/include/torch/utils.h
1 issues
equal - Function does not check the second iterator for over-read conditions
Security

Line: 90 Column: 87 CWE codes: 126
Suggestion: This function is often discouraged by most C++ coding standards in favor of its safer alternatives provided since C++14. Consider using a form of this function that checks the second iterator before potentially overflowing it

              
// Returns true if both t1, t2 are undefined or both are defined and equal
inline bool equal_if_defined(Tensor t1, Tensor t2) {
  return ((!t1.defined() && !t2.defined()) || (t1.defined() && t2.defined() && torch::equal(t1, t2)));
}

// RecordFunction API
using at::RecordFunctionCallback;
using at::addThreadLocalCallback;

            

Reported by FlawFinder.

torch/csrc/api/include/torch/serialize/tensor.h
1 issues
read - Check buffer boundaries if used in a loop including recursive loops
Security

Line: 17 Column: 11 CWE codes: 120 20

              inline serialize::InputArchive& operator>>(
    serialize::InputArchive& archive,
    Tensor& tensor) {
  archive.read("0", tensor);
  return archive;
}
} // namespace torch

            

Reported by FlawFinder.

torch/csrc/jit/jit_opt_limit.cpp
1 issues
getenv - Environment variables are untrustable input if they can be set by an attacker. They can have any content and length, and the same variable can be set more than once
Security

Line: 54 Column: 39 CWE codes: 807 20
Suggestion: Check environment variables carefully before using them

              }

bool opt_limit(const char* pass_name) {
  static const char* opt_limit = std::getenv("PYTORCH_JIT_OPT_LIMIT");
  // if nothing is provided, let's allow everything
  if (!opt_limit) {
    return true;
  }


            

Reported by FlawFinder.

torch/distributed/pipeline/sync/skip/namespace.py
1 issues
Attribute name "id" doesn't conform to snake_case naming style
Error

Line: 25 Column: 9

                  __slots__ = ("id",)

    def __init__(self) -> None:
        self.id = uuid.uuid4()

    def __repr__(self) -> str:
        return f"<Namespace '{self.id}'>"

    def __hash__(self) -> int:

            

Reported by Pylint.

torch/csrc/jit/jit_log.h
1 issues
getenv - Environment variables are untrustable input if they can be set by an attacker. They can have any content and length, and the same variable can be set more than once
Security

Line: 67 Column: 38 CWE codes: 807 20
Suggestion: Check environment variables carefully before using them

              
  // NOLINTNEXTLINE(cppcoreguidelines-pro-type-member-init)
  JitLoggingConfig() {
    const char* jit_log_level = std::getenv("PYTORCH_JIT_LOG_LEVEL");
    logging_levels.assign(jit_log_level == nullptr ? "" : jit_log_level);
    parse();
  }
  void parse();


            

Reported by FlawFinder.

torch/csrc/api/include/torch/ordered_dict.h
1 issues
equal - Function does not check the second iterator for over-read conditions
Security

Line: 511 Column: 15 CWE codes: 126
Suggestion: This function is often discouraged by most C++ coding standards in favor of its safer alternatives provided since C++14. Consider using a form of this function that checks the second iterator before potentially overflowing it

                if (a.index_ != b.index_) return false;
  if (a.items_.size() != b.items_.size()) return false;
  // NOTE: There's no point in comparing keys for items_, as we already know that index is equal.
  return std::equal(a.items_.begin(), a.items_.end(),
                    b.items_.begin(),
                    [](const Item& a, const Item& b)
                    { return a.value() == b.value(); });
}


            

Reported by FlawFinder.

torch/csrc/jit/frontend/script_type_parser.cpp
1 issues
strlen - Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected)
Security

Line: 170 Column: 39 CWE codes: 126

                         "must be subscripted with a type";

  auto typ = subscript_exprs[0];
  auto len = var.name().name().substr(strlen("BroadcastingList"));

  if (typ.kind() != TK_VAR)
    throw ErrorReport(subscript.value().range())
        << "Subscripted type must be a type identifier";


            

Reported by FlawFinder.