tensorflow/CVE-2021-37682-2.patch

41 lines
2.0 KiB
Diff
Raw Normal View History

From 537bc7c723439b9194a358f64d871dd326c18887 Mon Sep 17 00:00:00 2001
From: Mihai Maruseac <mihaimaruseac@google.com>
Date: Fri, 16 Jul 2021 09:35:48 -0700
Subject: [PATCH] Fix a null pointer exception caused by branching on
uninitialized data.
This is due to not checking that the params for the quantization exists. If there is no quantization, we should not access the `.params` field.
PiperOrigin-RevId: 385163909
Change-Id: I2beb8d50649b6542db224c163033fbcbaa49314f
---
tensorflow/lite/kernels/svdf.cc | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/tensorflow/lite/kernels/svdf.cc b/tensorflow/lite/kernels/svdf.cc
index 6c02508e26b1d..41a71c54a8c92 100644
--- a/tensorflow/lite/kernels/svdf.cc
+++ b/tensorflow/lite/kernels/svdf.cc
@@ -256,14 +256,21 @@ TfLiteStatus Prepare(TfLiteContext* context, TfLiteNode* node) {
output_temp_size_array));
// Calculate effective scales.
+ TF_LITE_ENSURE(context, input->quantization.type != kTfLiteNoQuantization);
auto* input_params =
reinterpret_cast<TfLiteAffineQuantization*>(input->quantization.params);
+ TF_LITE_ENSURE(context,
+ weights_feature->quantization.type != kTfLiteNoQuantization);
auto* weights_feature_params = reinterpret_cast<TfLiteAffineQuantization*>(
weights_feature->quantization.params);
+ TF_LITE_ENSURE(context, state->quantization.type != kTfLiteNoQuantization);
auto* state_params =
reinterpret_cast<TfLiteAffineQuantization*>(state->quantization.params);
+ TF_LITE_ENSURE(context,
+ weights_time->quantization.type != kTfLiteNoQuantization);
auto* weight_time_params = reinterpret_cast<TfLiteAffineQuantization*>(
weights_time->quantization.params);
+ TF_LITE_ENSURE(context, output->quantization.type != kTfLiteNoQuantization);
auto* output_params = reinterpret_cast<TfLiteAffineQuantization*>(
output->quantization.params);
const double effective_scale_1 = input_params->scale->data[0] *