Fix OOB write in grappler.

Discovered via internal fuzzing. PiperOrigin-RevId: 482097391
tensorflow · Oct 20, 2022 · c1b2cc4 · c1b2cc4
1 parent f578805
commit c1b2cc4
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/tensorflow/core/grappler/utils/functions.cc b/tensorflow/core/grappler/utils/functions.cc
@@ -291,6 +291,11 @@ Status MakeGrapplerFunctionItem(const FunctionDef& func,
 
   std::vector<const FunctionDef::ArgAttrs*> arg_attr(inputs.size(), nullptr);
   for (const auto& attr : func.arg_attr()) {
+    if (attr.first >= inputs.size()) {
+      return errors::InvalidArgument("Invalid attribute index, got ",
+                                     attr.first, " but expected less than ",
+                                     inputs.size());
+    }
     arg_attr.at(attr.first) = &attr.second;
   }