Skip to content

FIX Prevents segfault in SVC when internals are altered #21336

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 9 commits into from
Oct 20, 2021
Merged

FIX Prevents segfault in SVC when internals are altered #21336

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
dd3e3d8
FIX Prevents segfaul in SVC when internals are altered
thomasjpfan Oct 15, 2021
b705348
DOC Adds whats enw
thomasjpfan Oct 15, 2021
0ab1700
FIX Fixes errors
thomasjpfan Oct 15, 2021
ab6661c
DOC fix docstring whats new
thomasjpfan Oct 15, 2021
2879776
Merge remote-tracking branch 'upstream/main' into segfault_svc
thomasjpfan Oct 19, 2021
9940d01
CLN Nicer check
thomasjpfan Oct 19, 2021
1a0a207
Apply suggestions from code review
glemaitre Oct 20, 2021
1fde24e
move entry to 1.0.1
glemaitre Oct 20, 2021
a0c6b08
Merge remote-tracking branch 'origin/main' into pr/thomasjpfan/21336
glemaitre Oct 20, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions doc/whats_new/v1.0.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,6 +67,15 @@ Fixed models
names out from one step of a pipeline to the next. :pr:`21351` by
`Thomas Fan`_.

:mod:`sklearn.svm`
..................

- |Fix| :class:`svm.SVC` and :class:`svm.SVR` check for an inconsistency
in its internal representation and raise an error instead of segfaulting.
This fix also resolves
`CVE-2020-28975 <https://nvd.nist.gov/vuln/detail/CVE-2020-28975>`__.
:pr:`21336` by `Thomas Fan`_.

.. _changes_1_0:

Version 1.0.0
Expand Down
7 changes: 7 additions & 0 deletions sklearn/svm/_base.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -616,6 +616,13 @@ def _validate_for_predict(self, X):
"the number of samples at training time"
% (X.shape[1], self.shape_fit_[0])
)
# Fixes https://nvd.nist.gov/vuln/detail/CVE-2020-28975
# Check that _n_support is consistent with support_vectors
sv = self.support_vectors_
if not self._sparse and sv.size > 0 and self.n_support_.sum() != sv.shape[0]:
raise ValueError(
f"The internal representation of {self.__class__.__name__} was altered"
)
return X

@property
Expand Down
13 changes: 13 additions & 0 deletions sklearn/svm/tests/test_svm.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1371,3 +1371,16 @@ def string_kernel(X1, X2):
else: # regressor
assert_allclose(svc1.predict(data), svc2.predict(X))
assert_allclose(svc1.predict(data), svc3.predict(K))


def test_svc_raises_error_internal_representation():
"""Check that SVC raises error when internal representation is altered.
Non-regression test for #18891 and https://nvd.nist.gov/vuln/detail/CVE-2020-28975
"""
clf = svm.SVC(kernel="linear").fit(X, Y)
clf._n_support[0] = 1000000

msg = "The internal representation of SVC was altered"
with pytest.raises(ValueError, match=msg):
clf.predict(X)