Audit finding
- ID:
AUD-002
- Status: Verified defect
- Severity: Critical
- Confidence: High
- Audited revision:
2f479320d805a1f9f35ebe4afaaeeded48913a94
Problem
ModelReferenceAdaptiveControl::ComputeControl() loops over InputSize but indexes e.at(i, 0) where e has StateSize rows. A valid ModelReferenceAdaptiveControl<float, 1, 2> aborts on the second input; without bounds assertions this is undefined memory access. When InputSize < StateSize, state-error components are silently ignored.
Source:
|
const StateVector& x, const InputVector& r, T dt) |
|
{ |
|
xm = xm + (reference.A * xm + reference.B * r) * dt; |
|
|
|
const StateVector e{ x - xm }; |
|
|
|
const InputVector u{ thetaX * x + thetaR * r }; |
|
|
|
const T scale{ gamma * signB * dt }; |
|
for (std::size_t i = 0; i < InputSize; ++i) |
|
{ |
|
for (std::size_t j = 0; j < StateSize; ++j) |
|
thetaX.at(i, j) -= scale * e.at(i, 0) * x.at(j, 0); |
|
|
|
for (std::size_t j = 0; j < InputSize; ++j) |
|
thetaR.at(i, j) -= scale * e.at(i, 0) * r.at(j, 0); |
|
} |
|
|
The current update is also not a dimensionally general MIMO Lyapunov law; it needs an adaptation direction such as B^T P e, rather than the first input-count error entries. AdaptationLaw is stored but not used.
Acceptance criteria
Audit finding
AUD-0022f479320d805a1f9f35ebe4afaaeeded48913a94Problem
ModelReferenceAdaptiveControl::ComputeControl()loops overInputSizebut indexese.at(i, 0)whereehasStateSizerows. A validModelReferenceAdaptiveControl<float, 1, 2>aborts on the second input; without bounds assertions this is undefined memory access. WhenInputSize < StateSize, state-error components are silently ignored.Source:
numerical-toolbox-cpp/numerical/nonlinear_control/ModelReferenceAdaptiveControl.hpp
Lines 81 to 98 in 2f47932
The current update is also not a dimensionally general MIMO Lyapunov law; it needs an adaptation direction such as
B^T P e, rather than the first input-count error entries.AdaptationLawis stored but not used.Acceptance criteria
InputSizeunless dimensions guarantee safety.TEST_Fcases forInputSize > StateSizeandInputSize < StateSize.