Skip to content

fix(pickle): bound legacy PyTorch control streams #1619

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mldangelo-oai merged 3 commits into from
Jun 10, 2026
Merged

fix(pickle): bound legacy PyTorch control streams #1619

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
9affa28
fix(pickle): bound legacy PyTorch control streams
mldangelo-oai Jun 10, 2026
1c6427c
Merge remote-tracking branch 'origin/main' into mdangelo/codex/fix-le…
mldangelo-oai Jun 10, 2026
85c9f3d
fix: validate legacy PyTorch storage boundaries
mldangelo-oai Jun 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
- redact values compared against sensitive keys in generic exports and literal credential comparisons in CatBoost evidence
- preserve critical PyTorch malformed-ZIP symlink findings, valid Python 3.10 streamed ZIP64 descriptors, and selected subtype findings from complete nested and concatenated HDF5 user-block ZIPs while retaining bounded fail-closed preflight checks and avoiding structure-only ZIP route probes
- classify unsafe PyTorch ZIP symlink targets as critical archive-link findings while preserving safe relative links
- recognize canonical legacy PyTorch pickle-stream boundaries without treating raw tensor storage as incomplete pickle, binary-tail, or CVE coverage
- restore pickle CVE scan throughput, reprobe malformed stream separators, and route four-byte protocol-0 Joblib operands correctly
- bound manifest embedded-Jinja template collection while preserving findings across deep branches, cycles, and shared YAML aliases
- bound Jinja static render analysis and fail closed on CPU-heavy aliased, recursive, container-wrapped, and arithmetic range probes when sandbox workers are unavailable
Expand Down
Loading
Loading