Skip to content

Commit 8b30cfe

Browse files
authored
Out-of-bounds read in validateTensorLayout (pytorch#17131)
### Summary check sizes and dim are same length ### Test plan ``` cmake --build . --target tensor_parser_test ctest -R tensor_parser_test -V ```
1 parent 4e2ae9c commit 8b30cfe

2 files changed

Lines changed: 41 additions & 0 deletions

File tree

runtime/executor/tensor_parser_exec_aten.cpp

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -129,6 +129,12 @@ ET_NODISCARD Error validateTensorLayout(
129129
"Dim mismatch. Expected %d, got %zu.",
130130
dim,
131131
expected_layout.sizes().size());
132+
ET_CHECK_OR_RETURN_ERROR(
133+
s_tensor->dim_order()->size() == static_cast<size_t>(dim),
134+
InvalidExternalData,
135+
"Dim order size mismatch. Expected %d, got %zu.",
136+
dim,
137+
s_tensor->dim_order()->size());
132138
for (int i = 0; i < dim; i++) {
133139
ET_CHECK_OR_RETURN_ERROR(
134140
s_tensor->sizes()->Get(i) == expected_layout.sizes()[i],

runtime/executor/test/tensor_parser_test.cpp

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@
1010

1111
#include <executorch/extension/data_loader/file_data_loader.h>
1212
#include <executorch/runtime/core/exec_aten/exec_aten.h>
13+
#include <executorch/runtime/core/tensor_layout.h>
1314
#include <executorch/runtime/executor/test/managed_memory_manager.h>
1415
#include <executorch/schema/program_generated.h>
1516

@@ -23,7 +24,10 @@ using executorch::runtime::EValue;
2324
using executorch::runtime::FreeableBuffer;
2425
using executorch::runtime::Program;
2526
using executorch::runtime::Result;
27+
using executorch::runtime::Span;
28+
using executorch::runtime::TensorLayout;
2629
using executorch::runtime::deserialization::parseTensor;
30+
using executorch::runtime::deserialization::validateTensorLayout;
2731
using executorch::runtime::testing::ManagedMemoryManager;
2832
using torch::executor::util::FileDataLoader;
2933

@@ -188,3 +192,34 @@ TEST_F(TensorParserTest, TestMutableState) {
188192
}
189193
ASSERT_EQ(num_mutable_tensors, 2);
190194
}
195+
196+
// Tests that validateTensorLayout rejects tensors where dim_order is shorter
197+
// than sizes, preventing out-of-bounds reads.
198+
TEST(ValidateTensorLayoutTest, DimOrderSizeMismatchIsRejected) {
199+
flatbuffers::FlatBufferBuilder builder;
200+
201+
std::vector<int32_t> sizes = {2, 3, 4};
202+
std::vector<uint8_t> dim_order_short = {0};
203+
204+
auto tensor_offset = executorch_flatbuffer::CreateTensor(
205+
builder,
206+
executorch_flatbuffer::ScalarType::FLOAT,
207+
0,
208+
builder.CreateVector(sizes),
209+
builder.CreateVector(dim_order_short));
210+
builder.Finish(tensor_offset);
211+
212+
const auto* s_tensor = flatbuffers::GetRoot<executorch_flatbuffer::Tensor>(
213+
builder.GetBufferPointer());
214+
215+
std::vector<int32_t> expected_sizes = {2, 3, 4};
216+
std::vector<uint8_t> expected_dim_order = {0, 1, 2};
217+
auto layout = TensorLayout::create(
218+
Span<const int32_t>(expected_sizes.data(), expected_sizes.size()),
219+
Span<const uint8_t>(expected_dim_order.data(), expected_dim_order.size()),
220+
ScalarType::Float);
221+
ASSERT_TRUE(layout.ok());
222+
223+
EXPECT_EQ(
224+
validateTensorLayout(s_tensor, layout.get()), Error::InvalidExternalData);
225+
}

0 commit comments

Comments
 (0)