Skip to content

Fix integer overflow in NHWC convolution kernel size calculation #10710

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
YellowJune wants to merge 1 commit into
base: master
Choose a base branch
from
+54 −22
Open

Fix integer overflow in NHWC convolution kernel size calculation #10710

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
76 changes: 54 additions & 22 deletions src/operators/convolution-nhwc.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -563,7 +563,14 @@ struct convolution2d_nhwc_variant {
static enum xnn_status select_microkernel_type(
const struct convolution2d_nhwc_variant* variant,
struct convolution2d_nhwc_context* context) {
const size_t kernel_size = context->kernel_height * context->kernel_width;
size_t kernel_size;
if (!xnn_safe_mul(context->kernel_height, context->kernel_width, &kernel_size)) {
xnn_log_error(
"failed to create %s operator: kernel size (%" PRIu32 "x%" PRIu32 ") overflows size_t",
xnn_operator_type_to_string(context->operator_type),
context->kernel_width, context->kernel_height);
return xnn_status_unsupported_parameter;
}
const bool unit_subsampling = (context->subsampling_width | context->subsampling_height) == 1;
const bool any_padding = (context->input_padding_left | context->input_padding_top |
context->input_padding_right | context->input_padding_bottom) != 0;
Expand Down Expand Up @@ -737,7 +744,14 @@ static enum xnn_status create_convolution2d_nhwc(

convolution_op->weights_cache = context->weights_cache;

const size_t kernel_size = context->kernel_height * context->kernel_width;
size_t kernel_size;
if (!xnn_safe_mul(context->kernel_height, context->kernel_width, &kernel_size)) {
xnn_log_error(
"failed to create %s operator: kernel size (%" PRIu32 "x%" PRIu32 ") overflows size_t",
xnn_operator_type_to_string(context->operator_type),
context->kernel_width, context->kernel_height);
goto error;
}

size_t zero_size = 0;
switch (context->microkernel_type) {
Expand Down Expand Up @@ -1167,9 +1181,12 @@ static XNN_NO_SANITIZE_FUNCTION enum xnn_status init_dwconv_params_qu8(
return xnn_status_unsupported_hardware;
}

size_t kernel_size;
if (!xnn_safe_mul(context->kernel_height, context->kernel_width, &kernel_size)) {
return xnn_status_unsupported_parameter;
}
context->dwconv_ukernel =
find_dwconv_ukernel(context->kernel_height * context->kernel_width,
dwconv_config, XNN_MAX_QU8_DWCONV_UKERNELS);
find_dwconv_ukernel(kernel_size, dwconv_config, XNN_MAX_QU8_DWCONV_UKERNELS);
if XNN_LIKELY (context->dwconv_ukernel != NULL) {
context->dwconv_ukernel->init.qu8(
&context->dwconv_params.qu8, context->kernel_zero_point,
Expand All @@ -1193,9 +1210,12 @@ static XNN_NO_SANITIZE_FUNCTION enum xnn_status init_dwconv_params_qs8_qc8w(
return xnn_status_unsupported_hardware;
}

size_t kernel_size;
if (!xnn_safe_mul(context->kernel_height, context->kernel_width, &kernel_size)) {
return xnn_status_unsupported_parameter;
}
context->dwconv_ukernel =
find_dwconv_ukernel(context->kernel_height * context->kernel_width,
dwconv_config, XNN_MAX_QC8_DWCONV_UKERNELS);
find_dwconv_ukernel(kernel_size, dwconv_config, XNN_MAX_QC8_DWCONV_UKERNELS);
if XNN_LIKELY (context->dwconv_ukernel != NULL) {
context->dwconv_ukernel->init.qs8_qc8w(
&context->dwconv_params.qs8_qc8w, context->output_zero_point,
Expand All @@ -1216,9 +1236,12 @@ static XNN_NO_SANITIZE_FUNCTION enum xnn_status init_dwconv_params_f16(
xnn_operator_type_to_string(context->operator_type));
return xnn_status_unsupported_hardware;
}
size_t kernel_size;
if (!xnn_safe_mul(context->kernel_height, context->kernel_width, &kernel_size)) {
return xnn_status_unsupported_parameter;
}
context->dwconv_ukernel =
find_dwconv_ukernel(context->kernel_height * context->kernel_width,
dwconv_config, XNN_MAX_F16_DWCONV_UKERNELS);
find_dwconv_ukernel(kernel_size, dwconv_config, XNN_MAX_F16_DWCONV_UKERNELS);
if XNN_LIKELY (context->dwconv_ukernel != NULL) {
context->dwconv_ukernel->init.f16(&context->dwconv_params.f16,
context->fp16_output_min,
Expand All @@ -1239,9 +1262,12 @@ static XNN_NO_SANITIZE_FUNCTION enum xnn_status init_dwconv_params_f32(
xnn_operator_type_to_string(context->operator_type));
return xnn_status_unsupported_hardware;
}
size_t kernel_size;
if (!xnn_safe_mul(context->kernel_height, context->kernel_width, &kernel_size)) {
return xnn_status_unsupported_parameter;
}
context->dwconv_ukernel =
find_dwconv_ukernel(context->kernel_height * context->kernel_width,
dwconv_config, XNN_MAX_F32_DWCONV_UKERNELS);
find_dwconv_ukernel(kernel_size, dwconv_config, XNN_MAX_F32_DWCONV_UKERNELS);
if XNN_LIKELY (context->dwconv_ukernel != NULL) {
context->dwconv_ukernel->init.f32(&context->dwconv_params.f32,
context->output_min, context->output_max);
Expand Down Expand Up @@ -2648,7 +2674,10 @@ static enum xnn_status reshape_igemm(
const size_t groups = convolution_op->convolution_op->groups;
const size_t kernel_height = convolution_op->convolution_op->kernel_height;
const size_t kernel_width = convolution_op->convolution_op->kernel_width;
const size_t kernel_size = kernel_height * kernel_width;
size_t kernel_size;
if (!xnn_safe_mul(kernel_height, kernel_width, &kernel_size)) {
return xnn_status_out_of_memory;
}
const size_t output_height = convolution_op->convolution_op->output_height;
const size_t output_width = convolution_op->convolution_op->output_width;
const size_t output_size = output_height * output_width;
Expand Down Expand Up @@ -2947,7 +2976,10 @@ static enum xnn_status reshape_dwconv(
const size_t input_width = convolution_op->convolution_op->input_width;
const size_t kernel_height = convolution_op->convolution_op->kernel_height;
const size_t kernel_width = convolution_op->convolution_op->kernel_width;
const size_t kernel_size = kernel_height * kernel_width;
size_t kernel_size;
if (!xnn_safe_mul(kernel_height, kernel_width, &kernel_size)) {
return xnn_status_out_of_memory;
}
const size_t output_height = convolution_op->convolution_op->output_height;
const size_t output_width = convolution_op->convolution_op->output_width;
const size_t step_width =
Expand Down Expand Up @@ -3221,13 +3253,13 @@ static enum xnn_status reshape_convolution2d_nhwc(
compute_output_dimension_with_tf_same_padding(
input_width, convolution_op->convolution_op->stride_width);

const uint32_t effective_kernel_height =
(convolution_op->convolution_op->kernel_height - 1) *
convolution_op->convolution_op->dilation_height +
const size_t effective_kernel_height =
(size_t) (convolution_op->convolution_op->kernel_height - 1) *
(size_t) convolution_op->convolution_op->dilation_height +
1;
const uint32_t effective_kernel_width =
(convolution_op->convolution_op->kernel_width - 1) *
convolution_op->convolution_op->dilation_width +
const size_t effective_kernel_width =
(size_t) (convolution_op->convolution_op->kernel_width - 1) *
(size_t) convolution_op->convolution_op->dilation_width +
1;
const size_t total_padding_height =
doz((convolution_op->convolution_op->output_height - 1) *
Expand Down Expand Up @@ -3256,11 +3288,11 @@ static enum xnn_status reshape_convolution2d_nhwc(
const size_t padded_input_width = convolution_op->convolution_op->padding_left +
input_width + convolution_op->convolution_op->padding_right;
const size_t effective_kernel_height =
(convolution_op->convolution_op->kernel_height - 1) *
convolution_op->convolution_op->dilation_height + 1;
(size_t) (convolution_op->convolution_op->kernel_height - 1) *
(size_t) convolution_op->convolution_op->dilation_height + 1;
const size_t effective_kernel_width =
(convolution_op->convolution_op->kernel_width - 1) *
convolution_op->convolution_op->dilation_width + 1;
(size_t) (convolution_op->convolution_op->kernel_width - 1) *
(size_t) convolution_op->convolution_op->dilation_width + 1;
if (padded_input_height < effective_kernel_height ||
padded_input_width < effective_kernel_width) {
xnn_log_error(
Expand Down
Loading