Skip to content

Fix out_of_bounds_read in getConstantDataPtr (XNNCompiler.cpp) (T267371218) #19593

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
meta-codesync wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Fix out_of_bounds_read in getConstantDataPtr (XNNCompiler.cpp) (T267371218) #19593

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 21 additions & 0 deletions backends/xnnpack/runtime/XNNCompiler.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,7 @@
#include <executorch/extension/threadpool/threadpool.h>
#include <executorch/runtime/executor/pte_data_map.h>
#include <xnnpack.h>
#include <cinttypes>
#include <string>
#include <unordered_map>
#include <vector>
Expand Down Expand Up @@ -179,6 +180,7 @@ Result<const uint8_t*> getConstantDataPtr(
uint32_t buffer_idx,
GraphPtr flatbuffer_graph,
const uint8_t* constant_data_ptr,
uint64_t constant_data_size,
const NamedDataMap* named_data_map,
std::vector<FreeableBuffer>& freeable_buffers,
XNNWeightsCache* weights_cache) {
Expand Down Expand Up @@ -219,10 +221,20 @@ Result<const uint8_t*> getConstantDataPtr(
"Null constant_data entry at buffer_idx %u",
buffer_idx);
uint64_t offset = constant_data_offset->offset();
uint64_t entry_size = constant_data_offset->size();
bool has_named_key = flatbuffers::IsFieldPresent(
constant_data_offset, fb_xnnpack::ConstantDataOffset::VT_NAMED_KEY);
// If there is no tensor name
if (!has_named_key) {
ET_CHECK_OR_RETURN_ERROR(
offset <= constant_data_size &&
entry_size <= constant_data_size - offset,
InvalidProgram,
"ConstantDataOffset {offset=%" PRIu64 ", size=%" PRIu64
"} out of bounds for constant_data region of size %" PRIu64,
offset,
entry_size,
constant_data_size);
return constant_data_ptr + offset;
} else {
ET_CHECK_OR_RETURN_ERROR(
Expand Down Expand Up @@ -265,13 +277,15 @@ Result<const uint8_t*> getConstantDataPtr(
const fb_xnnpack::XNNTensorValue* tensor_value,
GraphPtr flatbuffer_graph,
const uint8_t* constant_data_ptr,
uint64_t constant_data_size,
const NamedDataMap* named_data_map,
std::vector<FreeableBuffer>& freeable_buffers,
XNNWeightsCache* weights_cache) {
return getConstantDataPtr(
tensor_value->constant_buffer_idx(),
flatbuffer_graph,
constant_data_ptr,
constant_data_size,
named_data_map,
freeable_buffers,
weights_cache);
Expand All @@ -288,6 +302,7 @@ Error defineTensor(
ValuePtr value,
GraphPtr flatbuffer_graph,
const uint8_t* constant_data_ptr,
uint64_t constant_data_size,
std::vector<uint32_t>& input_ids,
std::vector<uint32_t>& output_ids,
CompileAllocator& allocator,
Expand Down Expand Up @@ -345,6 +360,7 @@ Error defineTensor(
tensor_value,
flatbuffer_graph,
constant_data_ptr,
constant_data_size,
named_data_map,
freeable_buffers,
weights_cache);
Expand Down Expand Up @@ -500,6 +516,7 @@ Error defineTensor(
qparams->scale_buffer_idx(),
flatbuffer_graph,
constant_data_ptr,
constant_data_size,
named_data_map,
freeable_buffers,
weights_cache);
Expand Down Expand Up @@ -546,6 +563,7 @@ Error defineTensor(
qparams->scale_buffer_idx(),
flatbuffer_graph,
constant_data_ptr,
constant_data_size,
named_data_map,
freeable_buffers,
weights_cache);
Expand Down Expand Up @@ -1980,6 +1998,7 @@ ET_NODISCARD Error XNNCompiler::compileModel(
Result<XNNHeader> header = XNNHeader::Parse(buffer_pointer, num_bytes);
const uint8_t* flatbuffer_data = nullptr;
const uint8_t* constant_data = nullptr;
uint64_t constant_data_size = 0;
size_t flatbuffer_size = 0;
CompileAllocator compile_allocator;

Expand All @@ -1990,6 +2009,7 @@ ET_NODISCARD Error XNNCompiler::compileModel(
flatbuffer_size = header->flatbuffer_size;
constant_data = reinterpret_cast<const uint8_t*>(buffer_pointer) +
header->constant_data_offset;
constant_data_size = header->constant_data_size;
} else if (header.error() == Error::NotFound) {
flatbuffer_data = reinterpret_cast<const uint8_t*>(buffer_pointer);
flatbuffer_size = num_bytes;
Expand Down Expand Up @@ -2081,6 +2101,7 @@ ET_NODISCARD Error XNNCompiler::compileModel(
value,
flatbuffer_graph,
constant_data,
constant_data_size,
input_ids,
output_ids,
compile_allocator,
Expand Down
Loading