litert/tensor/arithmetic.h: bounds-check axis and index values before vector subscript#10702
Merged
copybara-service[bot] merged 1 commit intoJul 17, 2026
Conversation
Contributor
Author
|
@qukhan - flagging this for review. This PR addresses heap out-of-bounds reads in several litert/tensor/arithmetic.h graph-building functions (Concat, ReduceMax, Mean, Sum, Transpose, Pad) where attacker-controlled axis values or buffer indices are used as unchecked subscripts into shape vectors. |
Collaborator
|
There was a hiccup in our import flow, I think it should be good now. |
copybara-service Bot
pushed a commit
to google-ai-edge/LiteRT
that referenced
this pull request
Jul 15, 2026
-- eac46c23a8d86466db45046a2153ad333802aa05 by destro4evr-rgb <destro4evr@proton.me>: litert/tensor/arithmetic.h: bounds-check axis and index values before vector subscript Concatenation, ReduceMax, Mean, Sum, Transpose, Pad, and PadV2 each used axis values or buffer-derived indices as direct subscripts into heap-allocated std::vector shape vectors without validating that the values are within the vector's bounds. std::vector::operator[] is unchecked in release builds, so a negative value (implicitly cast to a near-SIZE_MAX size_t) or an index >= the vector size silently reads or writes past the heap allocation. The fix follows the same pattern used in PR #10464 for ExpandDims, Pack, and OneHot: validate the value against [0, shape.size()) before the subscript, and return an ErrorTensor on failure. For Pad and PadV2 the check confirms the padding buffer holds at least 2 * input_rank elements before the loop that reads b_data[i*2] and b_data[i*2+1]. FUTURE_COPYBARA_INTEGRATE_REVIEW=google/XNNPACK#10702 from destro4evr-rgb:fix/litert-arithmetic-axis-bounds-checks eac46c23a8d86466db45046a2153ad333802aa05 LiteRT-PiperOrigin-RevId: 946930488
Contributor
Author
destro4evr-rgb
force-pushed
the
fix/litert-arithmetic-axis-bounds-checks
branch
2 times, most recently
from
July 16, 2026 14:28
75a95ec to
23c5ae7
Compare
Contributor
Author
|
Hey @qukhan , rebased the PR onto current master to resolve the conflict from the LockedBufferSpan refactor. Should be clean now." |
copybara-service Bot
pushed a commit
that referenced
this pull request
Jul 16, 2026
-- 23c5ae7 by destro4evr-rgb <destro4evr@proton.me>: litert/tensor/arithmetic.h: bounds-check axis and index values before vector subscript Rebased onto master after lvalue LockedBufferSpan refactor. FUTURE_COPYBARA_INTEGRATE_REVIEW=#10702 from destro4evr-rgb:fix/litert-arithmetic-axis-bounds-checks 23c5ae7 PiperOrigin-RevId: 946930488
copybara-service Bot
pushed a commit
to google-ai-edge/LiteRT
that referenced
this pull request
Jul 16, 2026
-- 23c5ae781b34cbc55737c930ff7ba73423f0f715 by destro4evr-rgb <destro4evr@proton.me>: litert/tensor/arithmetic.h: bounds-check axis and index values before vector subscript Rebased onto master after lvalue LockedBufferSpan refactor. FUTURE_COPYBARA_INTEGRATE_REVIEW=google/XNNPACK#10702 from destro4evr-rgb:fix/litert-arithmetic-axis-bounds-checks 23c5ae781b34cbc55737c930ff7ba73423f0f715 LiteRT-PiperOrigin-RevId: 946930488
copybara-service Bot
pushed a commit
to google-ai-edge/LiteRT
that referenced
this pull request
Jul 16, 2026
-- 23c5ae781b34cbc55737c930ff7ba73423f0f715 by destro4evr-rgb <destro4evr@proton.me>: litert/tensor/arithmetic.h: bounds-check axis and index values before vector subscript Rebased onto master after lvalue LockedBufferSpan refactor. FUTURE_COPYBARA_INTEGRATE_REVIEW=google/XNNPACK#10702 from destro4evr-rgb:fix/litert-arithmetic-axis-bounds-checks 23c5ae781b34cbc55737c930ff7ba73423f0f715 LiteRT-PiperOrigin-RevId: 946930488
copybara-service Bot
pushed a commit
to google-ai-edge/LiteRT
that referenced
this pull request
Jul 16, 2026
-- 23c5ae781b34cbc55737c930ff7ba73423f0f715 by destro4evr-rgb <destro4evr@proton.me>: litert/tensor/arithmetic.h: bounds-check axis and index values before vector subscript Rebased onto master after lvalue LockedBufferSpan refactor. FUTURE_COPYBARA_INTEGRATE_REVIEW=google/XNNPACK#10702 from destro4evr-rgb:fix/litert-arithmetic-axis-bounds-checks 23c5ae781b34cbc55737c930ff7ba73423f0f715 LiteRT-PiperOrigin-RevId: 946930488
copybara-service Bot
pushed a commit
to google-ai-edge/LiteRT
that referenced
this pull request
Jul 16, 2026
-- 23c5ae781b34cbc55737c930ff7ba73423f0f715 by destro4evr-rgb <destro4evr@proton.me>: litert/tensor/arithmetic.h: bounds-check axis and index values before vector subscript Rebased onto master after lvalue LockedBufferSpan refactor. FUTURE_COPYBARA_INTEGRATE_REVIEW=google/XNNPACK#10702 from destro4evr-rgb:fix/litert-arithmetic-axis-bounds-checks 23c5ae781b34cbc55737c930ff7ba73423f0f715 LiteRT-PiperOrigin-RevId: 946930488
copybara-service Bot
pushed a commit
that referenced
this pull request
Jul 17, 2026
-- 23c5ae7 by destro4evr-rgb <destro4evr@proton.me>: litert/tensor/arithmetic.h: bounds-check axis and index values before vector subscript Rebased onto master after lvalue LockedBufferSpan refactor. FUTURE_COPYBARA_INTEGRATE_REVIEW=#10702 from destro4evr-rgb:fix/litert-arithmetic-axis-bounds-checks 23c5ae7 PiperOrigin-RevId: 946930488
copybara-service Bot
pushed a commit
to google-ai-edge/LiteRT
that referenced
this pull request
Jul 17, 2026
-- 23c5ae781b34cbc55737c930ff7ba73423f0f715 by destro4evr-rgb <destro4evr@proton.me>: litert/tensor/arithmetic.h: bounds-check axis and index values before vector subscript Rebased onto master after lvalue LockedBufferSpan refactor. FUTURE_COPYBARA_INTEGRATE_REVIEW=google/XNNPACK#10702 from destro4evr-rgb:fix/litert-arithmetic-axis-bounds-checks 23c5ae781b34cbc55737c930ff7ba73423f0f715 LiteRT-PiperOrigin-RevId: 946930488
Collaborator
|
Because #10765 got through and there's a merge conflict, this needs to be rebased again. |
… vector subscript Rebased onto master after lvalue LockedBufferSpan refactor.
destro4evr-rgb
force-pushed
the
fix/litert-arithmetic-axis-bounds-checks
branch
from
July 17, 2026 09:58
23c5ae7 to
9fe71df
Compare
Contributor
Author
copybara-service Bot
pushed a commit
to google-ai-edge/LiteRT
that referenced
this pull request
Jul 17, 2026
-- 9fe71df82d9a31e67235f7c05b820d89d41bcd0b by destro4evr-rgb <destro4evr@proton.me>: litert/tensor/arithmetic.h: bounds-check axis and index values before vector subscript Rebased onto master after lvalue LockedBufferSpan refactor. FUTURE_COPYBARA_INTEGRATE_REVIEW=google/XNNPACK#10702 from destro4evr-rgb:fix/litert-arithmetic-axis-bounds-checks 9fe71df82d9a31e67235f7c05b820d89d41bcd0b LiteRT-PiperOrigin-RevId: 946930488
copybara-service Bot
pushed a commit
to google-ai-edge/LiteRT
that referenced
this pull request
Jul 17, 2026
-- 9fe71df82d9a31e67235f7c05b820d89d41bcd0b by destro4evr-rgb <destro4evr@proton.me>: litert/tensor/arithmetic.h: bounds-check axis and index values before vector subscript Rebased onto master after lvalue LockedBufferSpan refactor. FUTURE_COPYBARA_INTEGRATE_REVIEW=google/XNNPACK#10702 from destro4evr-rgb:fix/litert-arithmetic-axis-bounds-checks 9fe71df82d9a31e67235f7c05b820d89d41bcd0b LiteRT-PiperOrigin-RevId: 946930488
copybara-service Bot
pushed a commit
to google-ai-edge/LiteRT
that referenced
this pull request
Jul 17, 2026
-- 9fe71df82d9a31e67235f7c05b820d89d41bcd0b by destro4evr-rgb <destro4evr@proton.me>: litert/tensor/arithmetic.h: bounds-check axis and index values before vector subscript Rebased onto master after lvalue LockedBufferSpan refactor. FUTURE_COPYBARA_INTEGRATE_REVIEW=google/XNNPACK#10702 from destro4evr-rgb:fix/litert-arithmetic-axis-bounds-checks 9fe71df82d9a31e67235f7c05b820d89d41bcd0b LiteRT-PiperOrigin-RevId: 946930488
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Addresses VRP report https://issuetracker.google.com/issues/533344097
Several graph-building functions in
litert/tensor/arithmetic.huse axis values or buffer-derived indices as direct subscripts into heap-allocatedstd::vectorshape vectors without validating that the values are within bounds.std::vector::operator[]is unchecked in release builds.Concatenation —
axisis passed directly by the caller and used as a subscript into the output and input shape vectors with no prior validation. A negative value implicitly casts to a SIZE_MAX-classsize_t, directing the read and write gigabytes past the heap allocation.ReduceMax, Mean, Sum — Each function reads axes from a tensor buffer as
int32_tvalues and uses them directly as subscripts into the output shape vector (o_info.shape[b_data[0]],o_info.shape[b_data[i]]). A value of -1 in the buffer becomes SIZE_MAX after the implicit cast tosize_t.Transpose — The permutation buffer is read as
int32_tvalues and used to index intoinput_shapeinside a loop. A negative permutation value produces a SIZE_MAX-class index. Additionally, if the permutation buffer contains more entries than the input rank, the loop writes tooutput_info.shape[i]beyond the resized vector length.Pad and PadV2 — The loop reads
b_data[i * 2]andb_data[i * 2 + 1]for every dimension, but the buffer length is not checked against2 * input_rankbefore the loop. A buffer shorter than2 * input_rankelements causes reads past the buffer's allocation.Fix
Validate axis/index values against
[0, shape.size())before any subscript, and return anErrorTensoron failure. For Pad and PadV2, confirm the locked buffer holds at least2 * o_info.shape.size()elements before entering the loop.This follows the same pattern introduced in #10464 for
ExpandDims,Pack, andOneHot.Affected functions
Concatenationaxisunchecked beforeshape[axis]ReduceMaxb_data[0]/b_data[i]unchecked beforeshape[b_data[*]]MeanSumTransposeperm_data[i]unchecked; perm length vs input rank uncheckedPad2 * input_rankbefore loopPadV2Precedent
PR #10464 ("Bounds-check data-derived axes and quantization params in tensor builder", merged 2026-07-02) fixed the same bug class in
ExpandDims,Pack, andOneHotin the same file. The fix here applies the identical pattern to the remaining unchecked functions.