|
5 | 5 | * LICENSE file in the root directory of this source tree. |
6 | 6 | */ |
7 | 7 |
|
8 | | -#include <list> |
9 | | -#include <numeric> |
| 8 | +#include <cinttypes> |
10 | 9 | using namespace std; |
11 | 10 |
|
| 11 | +#include <c10/util/safe_numerics.h> |
12 | 12 | #include <executorch/runtime/backend/interface.h> |
13 | 13 | #include <executorch/runtime/core/error.h> |
14 | 14 | #include <executorch/runtime/core/evalue.h> |
@@ -191,8 +191,18 @@ class VGFBackend final : public ::executorch::runtime::BackendInterface { |
191 | 191 | if (!io->is_input) |
192 | 192 | continue; |
193 | 193 |
|
194 | | - size_t io_size = accumulate( |
195 | | - io->size.begin(), io->size.end(), io->elt_size, std::multiplies<>()); |
| 194 | + size_t io_size = io->elt_size; |
| 195 | + for (int64_t dim : io->size) { |
| 196 | + ET_CHECK_OR_RETURN_ERROR( |
| 197 | + dim >= 0, |
| 198 | + InvalidArgument, |
| 199 | + "Negative dimension in IO size: %" PRId64, |
| 200 | + dim); |
| 201 | + ET_CHECK_OR_RETURN_ERROR( |
| 202 | + !c10::mul_overflows(io_size, static_cast<size_t>(dim), &io_size), |
| 203 | + InvalidArgument, |
| 204 | + "Overflow computing IO buffer size"); |
| 205 | + } |
196 | 206 |
|
197 | 207 | void* data; |
198 | 208 | if (!repr->map_io(io, &data)) { |
@@ -226,8 +236,18 @@ class VGFBackend final : public ::executorch::runtime::BackendInterface { |
226 | 236 | if (io->is_input) |
227 | 237 | continue; |
228 | 238 |
|
229 | | - size_t io_size = accumulate( |
230 | | - io->size.begin(), io->size.end(), io->elt_size, std::multiplies<>()); |
| 239 | + size_t io_size = io->elt_size; |
| 240 | + for (int64_t dim : io->size) { |
| 241 | + ET_CHECK_OR_RETURN_ERROR( |
| 242 | + dim >= 0, |
| 243 | + InvalidArgument, |
| 244 | + "Negative dimension in IO size: %" PRId64, |
| 245 | + dim); |
| 246 | + ET_CHECK_OR_RETURN_ERROR( |
| 247 | + !c10::mul_overflows(io_size, static_cast<size_t>(dim), &io_size), |
| 248 | + InvalidArgument, |
| 249 | + "Overflow computing IO buffer size"); |
| 250 | + } |
231 | 251 |
|
232 | 252 | void* data; |
233 | 253 | if (!repr->map_io(io, &data)) { |
|
0 commit comments