commit e173a3a89f7e97aaf35ea7d5831a11aa9cccf286
author Ian Hua <ianhua@google.com> Thu May 18 04:26:57 2023 +0000
committer Android (Google) Code Review <android-gerrit@google.com> Thu May 18 04:26:57 2023 +0000
tree 8b1b4d812719da043476f191535be105df8b6192
parent d46e900cf0aac075b5771286d40214e5a4fb0bc1
parent 79024562d2cce3f2dc6a3340301d65251497dd83

Merge "Fix OOB read in parseInputs in ShimPreparedModel.cpp" into tm-qpr-dev

shim_and_sl/ShimConverter.cpp

diff --git a/shim_and_sl/ShimConverter.cpp b/shim_and_sl/ShimConverter.cpp
index 2cbdc09..1ed0e31 100644
--- a/shim_and_sl/ShimConverter.cpp
+++ b/shim_and_sl/ShimConverter.cpp
@@ -128,6 +128,12 @@
 
         switch (operand.lifetime) {
             case OperandLifeTime::CONSTANT_COPY: {
+                if (operand.location.length + operand.location.offset >
+                    model.operandValues.size()) {
+                    *errorStatus = ErrorStatus::INVALID_ARGUMENT;
+                    return nullptr;
+                }
+
                 if (operand.location.length <=
                     ANEURALNETWORKS_MAX_SIZE_OF_IMMEDIATELY_COPIED_VALUES) {
                     resultModel.setOperandValue(