Copybara import of the project:

src/x32-unpool/x32-unpool-neon.c

@@ -18,6 +18,7 @@ void xnn_x32_unpool_ukernel__neon(
     const uint32_t* index,
     uint32_t** output)
 {
+  const size_t num_outputs = kernel_elements;
   // Pre-initialize outputs with constant.
   const uint32x4_t vfill = vdupq_n_u32(fill);
   uint32_t** os = output;
@@ -41,7 +42,13 @@ void xnn_x32_unpool_ukernel__neon(
   size_t offset = 0;
   do {
     const uint32_t i = *index++;
-    *((uint32_t*) ((uintptr_t) output[i] + offset)) = *input++;
+    const uint32_t v = *input++;
+    // Ignore indices outside the kernel_elements output pointers instead of
+    // dereferencing output[i] out of bounds. Valid unpooling indices are
+    // always < kernel_elements, so well-formed input is unaffected.
+    if (i < num_outputs) {
+      *((uint32_t*) ((uintptr_t) output[i] + offset)) = v;
+    }
     offset += sizeof(uint32_t);
   } while (--channels != 0);
 }

src/x32-unpool/x32-unpool-scalar.c

@@ -16,6 +16,7 @@ void xnn_x32_unpool_ukernel__scalar(
     const uint32_t* index,
     uint32_t** output)
 {
+  const size_t num_outputs = kernel_elements;
   // Pre-initialize outputs with constant.
   uint32_t** os = output;
   do {
@@ -30,7 +31,13 @@ void xnn_x32_unpool_ukernel__scalar(
   size_t offset = 0;
   do {
     const uint32_t i = *index++;
-    *((uint32_t*) ((uintptr_t) output[i] + offset)) = *input++;
+    const uint32_t v = *input++;
+    // Ignore indices outside the kernel_elements output pointers instead of
+    // dereferencing output[i] out of bounds. Valid unpooling indices are
+    // always < kernel_elements, so well-formed input is unaffected.
+    if (i < num_outputs) {
+      *((uint32_t*) ((uintptr_t) output[i] + offset)) = v;
+    }
     offset += sizeof(uint32_t);
   } while (--channels != 0);
 }

src/x32-unpool/x32-unpool-sse2.c

@@ -18,6 +18,7 @@ void xnn_x32_unpool_ukernel__sse2(
     const uint32_t* index,
     uint32_t** output)
 {
+  const size_t num_outputs = kernel_elements;
   // Pre-initialize outputs with constant.
   const __m128i vfill = _mm_set1_epi32((int) fill);
   uint32_t** os = output;
@@ -43,7 +44,13 @@ void xnn_x32_unpool_ukernel__sse2(
   size_t offset = 0;
   do {
     const uint32_t i = *index++;
-    *((uint32_t*) ((uintptr_t) output[i] + offset)) = *input++;
+    const uint32_t v = *input++;
+    // Ignore indices outside the kernel_elements output pointers instead of
+    // dereferencing output[i] out of bounds. Valid unpooling indices are
+    // always < kernel_elements, so well-formed input is unaffected.
+    if (i < num_outputs) {
+      *((uint32_t*) ((uintptr_t) output[i] + offset)) = v;
+    }
     offset += sizeof(uint32_t);
   } while (--channels != 0);
 }

src/x32-unpool/x32-unpool-wasmsimd.c

@@ -18,6 +18,7 @@ void xnn_x32_unpool_ukernel__wasmsimd(
     const uint32_t* index,
     uint32_t** output)
 {
+  const size_t num_outputs = kernel_elements;
   // Pre-initialize outputs with constant.
   const v128_t vfill = wasm_i32x4_splat(fill);
   uint32_t** os = output;
@@ -43,7 +44,13 @@ void xnn_x32_unpool_ukernel__wasmsimd(
   size_t offset = 0;
   do {
     const uint32_t i = *index++;
-    *((uint32_t*) ((uintptr_t) output[i] + offset)) = *input++;
+    const uint32_t v = *input++;
+    // Ignore indices outside the kernel_elements output pointers instead of
+    // dereferencing output[i] out of bounds. Valid unpooling indices are
+    // always < kernel_elements, so well-formed input is unaffected.
+    if (i < num_outputs) {
+      *((uint32_t*) ((uintptr_t) output[i] + offset)) = v;
+    }
     offset += sizeof(uint32_t);
   } while (--channels != 0);
 }