Skip to content

resize-bilinear: guard indirection buffer and packed weights size against overflow#10780

Open
destro4evr-rgb wants to merge 1 commit into
google:masterfrom
destro4evr-rgb:fix/resize-bilinear-indirection-buffer-size-overflow
Open

resize-bilinear: guard indirection buffer and packed weights size against overflow#10780
destro4evr-rgb wants to merge 1 commit into
google:masterfrom
destro4evr-rgb:fix/resize-bilinear-indirection-buffer-size-overflow

Conversation

@destro4evr-rgb

Copy link
Copy Markdown
Contributor

xnn_reshape_resize_bilinear2d_nhwc_* and xnn_reshape_resize_bilinear2d_nchw_* computed the indirection buffer size and packed-weights size with raw multiplication:

sizeof(void*) * (output_height * output_width * 4)
(output_height * output_width * 2) << log2_weight_element_size

On 32-bit targets (WebAssembly, ARM32) where size_t is 32 bits, the product overflows when output_height * output_width >= 2^28 (e.g. 16384 × 16384), wrapping the computed size to zero. xnn_reallocate_memory then returns a zero-size allocation, and xnn_indirection_init_resize_bilinear2d_* subsequently writes 4 * output_height * output_width pointer entries into this undersized buffer — a heap out-of-bounds write.

Replace the raw multiplications with chained xnn_safe_mul calls that return xnn_status_out_of_memory on overflow, matching the pattern used in other reshape paths.

…inst overflow

xnn_reshape_resize_bilinear2d_nhwc_* and xnn_reshape_resize_bilinear2d_nchw_*
computed the indirection buffer size and packed-weights size with raw
multiplication:

  sizeof(void*) * (output_height * output_width * 4)
  (output_height * output_width * 2) << log2_weight_element_size

On 32-bit targets (WebAssembly, ARM32) where size_t is 32 bits, the product
overflows when output_height * output_width >= 2^28 (e.g. 16384 x 16384),
wrapping the allocation size to zero. xnn_indirection_init_resize_bilinear2d_*
then writes 4 * output_height * output_width pointer entries into this
undersized buffer, producing a heap out-of-bounds write.

Replace the raw multiplications with chained xnn_safe_mul calls that return
xnn_status_out_of_memory on overflow, matching the pattern used in other
reshape paths.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant