Skip to content

Commit a65411a

Browse files
Fix OOB write in grappler.
Discovered via internal fuzzing. PiperOrigin-RevId: 482097391
1 parent 4a08a44 commit a65411a

File tree

1 file changed

+5
-0
lines changed

1 file changed

+5
-0
lines changed

Diff for: tensorflow/core/grappler/utils/functions.cc

+5
Original file line numberDiff line numberDiff line change
@@ -291,6 +291,11 @@ Status MakeGrapplerFunctionItem(const FunctionDef& func,
291291

292292
std::vector<const FunctionDef::ArgAttrs*> arg_attr(inputs.size(), nullptr);
293293
for (const auto& attr : func.arg_attr()) {
294+
if (attr.first >= inputs.size()) {
295+
return errors::InvalidArgument("Invalid attribute index, got ",
296+
attr.first, " but expected less than ",
297+
inputs.size());
298+
}
294299
arg_attr.at(attr.first) = &attr.second;
295300
}
296301

0 commit comments

Comments
 (0)