OneFlow Floating-Point Exception Vulnerability in Column Stack Component Allowing Denial-of-Service

A floating-point exception vulnerability has been identified in the OneFlow library, specifically in the column_stack component, version 0.9.0. This vulnerability allows attackers to cause a denial-of-service by sending a crafted input that triggers the exception.

Impact

Exploitation of this vulnerability leads to a floating-point exception, causing a core dump and potentially disrupting the application's normal operation.

Reproduction

The vulnerability can be reproduced by calling the flow.argsort() function on an empty tensor. This operation attempts to sort an invalid input size, resulting in a floating-point exception and a core dump.