Skip to content
Permalink
Browse files Browse the repository at this point in the history
Fix integer overflow leading to divide by zero error in Unravel index…
… kernel when dimensions product exceeds max int value.

PiperOrigin-RevId: 413250052
Change-Id: I9450b6e8acecd2e881a64b882e2b7c70e8e9289a
  • Loading branch information
ishark authored and tensorflower-gardener committed Nov 30, 2021
1 parent 4d00cd5 commit 58b34c6
Show file tree
Hide file tree
Showing 2 changed files with 40 additions and 1 deletion.
27 changes: 26 additions & 1 deletion tensorflow/core/kernels/unravel_index_op.cc
Expand Up @@ -13,6 +13,10 @@ See the License for the specific language governing permissions and
limitations under the License.
==============================================================================*/

#include <cstdint>

#include "tensorflow/core/framework/types.pb.h"
#include "tensorflow/core/platform/types.h"
#define EIGEN_USE_THREADS

#include "tensorflow/core/framework/op_kernel.h"
Expand All @@ -35,7 +39,8 @@ typedef Eigen::ThreadPoolDevice CPUDevice;
template <typename Tidx>
class UnravelIndexOp : public OpKernel {
public:
explicit UnravelIndexOp(OpKernelConstruction* ctx) : OpKernel(ctx) {}
explicit UnravelIndexOp(OpKernelConstruction* ctx)
: OpKernel(ctx), dtidx_(DataTypeToEnum<Tidx>::v()) {}

void Compute(OpKernelContext* ctx) override {
const Tensor& indices_tensor = ctx->input(0);
Expand All @@ -54,12 +59,31 @@ class UnravelIndexOp : public OpKernel {

auto dims = dims_tensor.vec<Tidx>();
// Make sure dims does not contain a zero
double prod = 1;
uint64_t limit;
if (dtidx_ == DataType::DT_INT64) {
limit = kint64max;
} else {
limit = kint32max;
}

for (int i = 0; i < dims.size(); i++) {
OP_REQUIRES(
ctx, dims(i) != 0,
errors::InvalidArgument("Input dims cannot contain a dim of zero, "
"but dims contains zero at index ",
i));
OP_REQUIRES(ctx, dims(i) > 0,
errors::InvalidArgument(
"Input dims cannot be negative. Got dim = ", dims(i),
" at index ", i));
// Check interger overflow
OP_REQUIRES(
ctx, prod <= limit / dims(i),
errors::InvalidArgument("Input dims product is causing integer "
"overflow: (",
dims, ")"));
prod = (prod * dims(i));
}

// Check to make sure indices is not out of boundary
Expand Down Expand Up @@ -132,6 +156,7 @@ class UnravelIndexOp : public OpKernel {
strides_shifted.reshape(reshape).broadcast(bcast);
}
}
const DataType dtidx_;
};

#define REGISTER_KERNEL(type) \
Expand Down
14 changes: 14 additions & 0 deletions tensorflow/python/kernel_tests/array_ops/array_ops_test.py
Expand Up @@ -1580,6 +1580,20 @@ def testUnravelIndexZeroDim(self):
dims = constant_op.constant([3, 0], dtype=dtype)
self.evaluate(array_ops.unravel_index(indices=indices, dims=dims))

def testUnravelIndexIntegerOverflow(self):
with self.cached_session():
for dtype in [dtypes.int32, dtypes.int64]:
with self.assertRaisesRegex(
errors.InvalidArgumentError,
r"Input dims product is causing integer overflow"):
indices = constant_op.constant(-0x100000, dtype=dtype)
if dtype == dtypes.int32:
value = 0x10000000
else:
value = 0x7FFFFFFFFFFFFFFF
dims = constant_op.constant([value, value], dtype=dtype)
self.evaluate(array_ops.unravel_index(indices=indices, dims=dims))


class GuaranteeConstOpTest(test_util.TensorFlowTestCase):

Expand Down

0 comments on commit 58b34c6

Please sign in to comment.