Skip to content

Fix: Add parameter magnitude validation in signal kernel Prepare functions#3594

Open
foodlook wants to merge 6 commits into
tensorflow:mainfrom
foodlook:fix-signal-kernel-prepare-validation
Open

Fix: Add parameter magnitude validation in signal kernel Prepare functions#3594
foodlook wants to merge 6 commits into
tensorflow:mainfrom
foodlook:fix-signal-kernel-prepare-validation

Conversation

@foodlook

Copy link
Copy Markdown

Summary

Add TF_LITE_ENSURE magnitude checks in 6 signal kernel Prepare functions to prevent out-of-bounds memory access and divide-by-zero from crafted model parameters.

Problem

Each signal kernel's Prepare validates tensor dimension count and type but never the dimension values or the relationship between op flexbuffer parameters and buffer sizes. A crafted .tflite model can set e.g. frame_step > frame_size, input_length > fft_length, or n_frames = 0, triggering heap-buffer-overflow or divide-by-zero in Eval.

All 7 sinks are dynamically proven with ASan/UBSan crashes on the real signal/src/ functions.

Changes

File Added Checks
overlap_add.cc frame_size>0, n_frames>0, frame_step>0, frame_step<=frame_size
rfft.cc fft_length>0, input_length>0, input_length<=fft_length
energy.cc start_index>=0, end_index>start_index, end_index<=input_elems
window.cc weight_size>0, input_size>0, input_size%weight_size==0, input==output size
filter_bank_spectral_subtraction.cc num_channels>0, matches input/output/noise dims
pcan.cc input_elems>0, matches noise_estimate/output dims

References

  • Google Issue Tracker: #523091874
  • ASan crash evidence: 7/7 sinks reproduced with libFuzzer + AddressSanitizer

Testing

The fix adds early-return kTfLiteError for invalid parameters that previously caused undefined behavior. Existing tests should pass unchanged (they use valid parameters).

@foodlook foodlook requested a review from a team as a code owner June 12, 2026 06:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant