commit dc685b0f44a0e004931858df10379b3c189165fc
author Android Build Coastguard Worker <android-build-coastguard-worker@google.com> Thu Dec 14 16:37:42 2023 +0000
committer Android Build Coastguard Worker <android-build-coastguard-worker@google.com> Thu Dec 14 16:37:42 2023 +0000
tree 0bc8d0176af9793a6d591a0902c1edc132338d61
parent 359e47242dadb7dd459c9bb19a2147c2d596f7b3
parent 6032003f1247f314d91048cf94555b706567e6cd

Snap for 11219529 from 6032003f1247f314d91048cf94555b706567e6cd to mainline-tzdata4-release

Change-Id: I84346833314f0a40e593987836563bb2b5e02e03

shim_and_sl/ShimConverter.cpp

diff --git a/shim_and_sl/ShimConverter.cpp b/shim_and_sl/ShimConverter.cpp
index 2cbdc09..9914af1 100644
--- a/shim_and_sl/ShimConverter.cpp
+++ b/shim_and_sl/ShimConverter.cpp
@@ -51,6 +51,10 @@
         size_t subgraphIndex, const std::vector<uint8_t>& copiedOperandValues,
         ErrorStatus* errorStatus) {
     *errorStatus = ErrorStatus::NONE;
+    if (allModels == nullptr || subgraphIndex >= (*allModels).size()) {
+        *errorStatus = ErrorStatus::INVALID_ARGUMENT;
+        return nullptr;
+    }
     if ((*allModels)[subgraphIndex].has_value()) {
         return (*allModels)[subgraphIndex]->getHandle();
     }
@@ -128,6 +132,12 @@
 
         switch (operand.lifetime) {
             case OperandLifeTime::CONSTANT_COPY: {
+                if (operand.location.length + operand.location.offset >
+                    model.operandValues.size()) {
+                    *errorStatus = ErrorStatus::INVALID_ARGUMENT;
+                    return nullptr;
+                }
+
                 if (operand.location.length <=
                     ANEURALNETWORKS_MAX_SIZE_OF_IMMEDIATELY_COPIED_VALUES) {
                     resultModel.setOperandValue(
@@ -144,6 +154,10 @@
                 break;
             }
             case OperandLifeTime::CONSTANT_POOL: {
+                if (operand.location.poolIndex >= memoryPools.size()) {
+                    *errorStatus = ErrorStatus::INVALID_ARGUMENT;
+                    return nullptr;
+                }
                 resultModel.setOperandValueFromMemory(
                         i, memoryPools[operand.location.poolIndex].get(), operand.location.offset,
                         operand.location.length);

shim_and_sl/ShimPreparedModel.cpp

diff --git a/shim_and_sl/ShimPreparedModel.cpp b/shim_and_sl/ShimPreparedModel.cpp
index 178cc1c..840d65a 100644
--- a/shim_and_sl/ShimPreparedModel.cpp
+++ b/shim_and_sl/ShimPreparedModel.cpp
@@ -85,6 +85,11 @@
     }
 
     const auto& model = mMainAndReferencedModels[0];
+
+    if (request.inputs.size() > model.getInputs().size()) {
+        return ErrorStatus::INVALID_ARGUMENT;
+    }
+
     // set inputs
     for (int i = 0; i < request.inputs.size(); ++i) {
         const auto& input = request.inputs[i];
@@ -107,6 +112,9 @@
         }
     }
 
+    if (request.outputs.size() > model.getOutputs().size()) {
+        return ErrorStatus::INVALID_ARGUMENT;
+    }
     // set outputs
     for (int i = 0; i < request.outputs.size(); ++i) {
         const auto& output = request.outputs[i];