Skip to content

Commit 62014eb

Browse files
lucylqfacebook-github-bot
authored andcommitted
Fix stack buffer overflow in resize_tensor
Summary: `new_sizes_casted` is created with size kTensorDimensionLimit. Make sure that new_sizes_ndim is <= kTensorDimensionLimit before resizing. Differential Revision: D86361111
1 parent 2bb8055 commit 62014eb

File tree

1 file changed

+7
-0
lines changed

1 file changed

+7
-0
lines changed

runtime/core/exec_aten/util/tensor_util.h

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1212,6 +1212,13 @@ ET_NODISCARD inline Error resize_tensor(
12121212
std::array<executorch::aten::SizesType, kTensorDimensionLimit>
12131213
new_sizes_casted{};
12141214
size_t new_sizes_ndim = new_sizes.size();
1215+
ET_CHECK_OR_RETURN_ERROR(
1216+
new_sizes_ndim <= kTensorDimensionLimit,
1217+
InvalidArgument,
1218+
"new_sizes_ndim %zu is greater than kTensorDimensionLimit %zu",
1219+
new_sizes_ndim,
1220+
kTensorDimensionLimit
1221+
);
12151222
for (const auto i : c10::irange(new_sizes_ndim)) {
12161223
new_sizes_casted[i] =
12171224
static_cast<executorch::aten::SizesType>(new_sizes[i]);

0 commit comments

Comments
 (0)