Skip to content

Revert xnnpack runtime check #18847

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
lucylq merged 1 commit into from
Apr 13, 2026
+1 −10
Merged

Revert xnnpack runtime check #18847

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 1 addition & 10 deletions backends/xnnpack/runtime/XNNCompiler.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1859,18 +1859,9 @@ ET_NODISCARD Error XNNCompiler::compileModel(
xnn_status_to_string(status));

// create xnnpack subgraph
uint32_t num_externs = flatbuffer_graph->num_externs();
uint32_t num_values = flatbuffer_graph->xvalues()->size();
ET_CHECK_OR_RETURN_ERROR(
num_externs <= num_values,
InvalidProgram,
"num_externs (%u) exceeds total number of values (%u)",
num_externs,
num_values);

xnn_subgraph_t subgraph_ptr = nullptr;
status = xnn_create_subgraph(
/*external_value_ids=*/num_externs,
/*external_value_ids=*/flatbuffer_graph->num_externs(),
/*flags=*/0,
&subgraph_ptr);
Comment on lines 1862 to 1866
Copy link

Copilot AI Apr 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Removing the num_externs <= xvalues->size() guard means a malformed/hostile flatbuffer can set num_externs to a very large value, potentially causing excessive allocation/slowdown (or OOM) inside xnn_create_subgraph. Consider adding a safer sanity check instead: e.g., scan xvalues to compute max_external_id actually referenced (and validate external_id < num_externs for any external value), then pass max_external_id + 1 (or a bounded value) to xnn_create_subgraph and return InvalidProgram on inconsistency.

Copilot uses AI. Check for mistakes.
ET_CHECK_OR_RETURN_ERROR(
Expand Down
Loading