Skip to content

Use-after free of IMGDNN outputs #1

@robquill

Description

@robquill

ANeuralNetworksExecution_notifyWait calls imgdnnMemoryLock on memory which has already been destroyed in ANeuralNetworksExecution_startCompute.

This is because:

  • ANeuralNetworksExecution_setOutput adds to output to execution->imgdnn_memories and execution->host_output_memories
  • All memory objects in imgdnn_memories are destroyed at the end of ANeuralNetworksExecution_startCompute
  • ANeuralNetworksExecution_notifyWait calls imgdnnMemoryLock on each of the objects in host_output_memories which includes the object previously freed in ANeuralNetworksExecution_startCompute

Fix is to not add outputs to imgdnn_memories and have ANeuralNetworksExecution_notifyWait destroy the output objects.

Fixes OCL: Invalid memory object errors in test_serialize and test_binary.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions