)]}'
{
  "commit": "f2bcea10ee5782edc886119044a23acb79e6fba6",
  "tree": "c9f45d77192b698bca5d8724ac61969ad0057c7b",
  "parents": [
    "e8ad3fa0b85956c9901f6d76a8f610d2de6af746"
  ],
  "author": {
    "name": "Eylon Eliyahu Krause",
    "email": "64223519+EylonKrause@users.noreply.github.com",
    "time": "Mon Jul 20 16:24:05 2026 +0300"
  },
  "committer": {
    "name": "GitHub",
    "email": "noreply@github.com",
    "time": "Mon Jul 20 15:24:05 2026 +0200"
  },
  "message": "[Util] Fix 32-bit wrap of util.string.format placeholder-count check (#24685)\n\n## Summary\nCompute `util.string.format`\u0027s expected-operand count in 64-bit so a\nnear-`UINT_MAX` placeholder index cannot wrap the check and slip past\nverification into an out-of-bounds access.\n\n## Context\n`util.string.format` interpolates its operands into `{N}`-style\nplaceholders. Its verifier — and `StringFormatOp::fold` — determine how\nmany operands the op should have from the highest placeholder index in\nthe format string, computed as `maxArgIndex + 1`. `maxArgIndex` was a\n32-bit `unsigned`.\n\n## Problem\nA format string with an explicit placeholder index of `UINT_MAX` makes\n`maxArgIndex + 1` overflow to `0`, so the verifier expects `0` operands\nand accepts the op even though the placeholder references argument\n`4294967295`. `fold` (and the verifier\u0027s own indexing) then read\n`argStrings[4294967295]` on an empty list — an out-of-bounds read. For\nexample, before this change the following op passed verification:\n```mlir\n%0 \u003d util.string.format \"{4294967295}\"() : () -\u003e !util.buffer\n```\n\n## Fix\nCast `maxArgIndex` to `uint64_t` so `maxArgIndex + 1` no longer wraps; an\nout-of-range placeholder is now rejected at verification. The same\ncomputation exists in two copies of `parseFormatString` (the verifier in\n`UtilOps.cpp` and the folder in `UtilOpFolders.cpp`); both are updated.\n\n`string_format_index_overflow` in `op_verification.mlir` checks the op\nabove is now rejected with a diagnostic instead of passing verification.\n\n---\nDisclosure: this contribution was authored with an AI coding assistant\n(Claude) and reviewed before submission.\n\nSigned-off-by: Eylon Krause \u003ceylon1909@gmail.com\u003e",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "09297dea397edb9ae6e07fe3c7a7f8e128654200",
      "old_mode": 33188,
      "old_path": "compiler/src/iree/compiler/Dialect/Util/IR/UtilOpFolders.cpp",
      "new_id": "7b579039ab967edef1359a82d9cbd480ac333475",
      "new_mode": 33188,
      "new_path": "compiler/src/iree/compiler/Dialect/Util/IR/UtilOpFolders.cpp"
    },
    {
      "type": "modify",
      "old_id": "7c31bd77cbde7d64040764e33405682dbb1a1eea",
      "old_mode": 33188,
      "old_path": "compiler/src/iree/compiler/Dialect/Util/IR/UtilOps.cpp",
      "new_id": "536d253ad4eee7c4c080843b9c504358ecc3b42d",
      "new_mode": 33188,
      "new_path": "compiler/src/iree/compiler/Dialect/Util/IR/UtilOps.cpp"
    },
    {
      "type": "modify",
      "old_id": "69a3cf156b53b36312ab0b7fbf557ef34d0a95ac",
      "old_mode": 33188,
      "old_path": "compiler/src/iree/compiler/Dialect/Util/IR/test/op_verification.mlir",
      "new_id": "1a2a7b590cac64825e172ce59dcd3f1a9fda4be0",
      "new_mode": 33188,
      "new_path": "compiler/src/iree/compiler/Dialect/Util/IR/test/op_verification.mlir"
    }
  ]
}