Summary

BytesRequiredForTensor() and TfLiteEvalTensorByteLength() compute tensor byte size using int element_count, which overflows when model-supplied dimensions are large (e.g., 65536 x 65536 wraps int32 to 0). The undersized allocation leads to heap buffer overflow when kernels later write tensor data using the actual dimensions.

Fix

• Change element_count from int to size_t
• Add overflow detection via division check after each multiplication
• Return kTfLiteError on overflow or non-positive dimensions
• Both functions run during Setup (model loading), consistent with the Error Handling Guide's recommendation to validate model-provided parameters early

This replaces the previous PR #3533 which was closed for not following the Error Handling Guide.

Alignment with Error Handling Guide

Per Section 2 (Phase 1: Setup & Initialization):

"Model-provided parameters: Check the number of inputs/outputs, tensor types, and tensor shapes."

These functions are called during InitializeTfLiteTensorFromFlatbuffer (Setup phase). The fix uses kTfLiteError return which callers propagate via TF_LITE_ENSURE_STATUS, keeping ROM cost low (no additional string literals).

Testing

Verified with ASan-enabled build: crafted model with shape [65536, 65536] now returns kTfLiteError instead of allocating 0 bytes and overflowing.

Fixes GHSA-7rx3-jmhh-gq5m