Skip to content
Permalink
Browse files Browse the repository at this point in the history
Validate real and expected type of arguments to cwise ops.
Without this validation, it is possible to trigger a `CHECK`-fail denial of service.

This is a rollforward of a previous commit which was rolled back as it was relying on RTTI. This time we don't use RTTI, we replace `typeid(Tin).name()` with a double function call, `DataTypeString(DataTypeToEnum<Tin>::v())`.

PiperOrigin-RevId: 409340416
Change-Id: I96080b2796729a3a9b65e7c68307ac276070f2f0
  • Loading branch information
mihaimaruseac authored and tensorflower-gardener committed Nov 12, 2021
1 parent c7db81b commit a7c02f1
Showing 1 changed file with 10 additions and 0 deletions.
10 changes: 10 additions & 0 deletions tensorflow/core/kernels/cwise_ops_common.h
Expand Up @@ -87,7 +87,17 @@ class BinaryOp : public BinaryOpShared {

void Compute(OpKernelContext* ctx) override {
const Tensor& input_0 = ctx->input(0);
OP_REQUIRES(ctx, input_0.dtype() == DataTypeToEnum<Tin>::v(),
errors::InvalidArgument(
"Expected tensor of type ",
DataTypeString(DataTypeToEnum<Tin>::v()), " but got type ",
DataTypeString(input_0.dtype())));
const Tensor& input_1 = ctx->input(1);
OP_REQUIRES(ctx, input_1.dtype() == DataTypeToEnum<Tin>::v(),
errors::InvalidArgument(
"Expected tensor of type ",
DataTypeString(DataTypeToEnum<Tin>::v()), " but got type ",
DataTypeString(input_1.dtype())));
const Device& eigen_device = ctx->eigen_device<Device>();
bool error = false;
bool* const error_ptr = Functor::has_errors ? &error : nullptr;
Expand Down

0 comments on commit a7c02f1

Please sign in to comment.