Fix out of Bounds Read in convertSubgraphFromHAL in ShimConverter.cpp…

… in libneuralnetworks_shim_static Bug: 269270167 Test: N/A (cherry picked from commit 4bf7bb6b50b412678a681d29f7ced70a4d737762) (cherry picked from https://googleplex-android-review.googlesource.com/q/commit:244ac21307a785d49930d4c7e289b74856fa9647) Merged-In: I33272284b965efcbb531f64cbf838a0d59c28e00 Change-Id: I33272284b965efcbb531f64cbf838a0d59c28e00
GrapheneOS-Archive · Sep 6, 2023 · a1370bd · a1370bd
1 parent beaa8f0
commit a1370bd
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/shim_and_sl/ShimConverter.cpp b/shim_and_sl/ShimConverter.cpp
@@ -150,6 +150,10 @@ ANeuralNetworksModel* convertSubgraphFromHAL(
                 break;
             }
             case OperandLifeTime::CONSTANT_POOL: {
+                if (operand.location.poolIndex >= memoryPools.size()) {
+                    *errorStatus = ErrorStatus::INVALID_ARGUMENT;
+                    return nullptr;
+                }
                 resultModel.setOperandValueFromMemory(
                         i, memoryPools[operand.location.poolIndex].get(), operand.location.offset,
                         operand.location.length);