commit 244ac21307a785d49930d4c7e289b74856fa9647
author Ian Hua <ianhua@google.com> Thu Jul 06 10:05:36 2023 +0000
committer Ian Hua <ianhua@google.com> Thu Jul 06 12:48:45 2023 +0000
tree 25c7f816de2a7a9f911ebf748082e83d72cdba92
parent a639c932994bfa1c7c401a9fc74af0577e286fb2

Fix out of Bounds Read in convertSubgraphFromHAL in ShimConverter.cpp in libneuralnetworks_shim_static

Bug: 269270167
Change-Id: I33272284b965efcbb531f64cbf838a0d59c28e00
Test: N/A
(cherry picked from commit 4bf7bb6b50b412678a681d29f7ced70a4d737762)

shim_and_sl/ShimConverter.cpp

diff --git a/shim_and_sl/ShimConverter.cpp b/shim_and_sl/ShimConverter.cpp
index 1ed0e31..4830c5d 100644
--- a/shim_and_sl/ShimConverter.cpp
+++ b/shim_and_sl/ShimConverter.cpp
@@ -150,6 +150,10 @@
                 break;
             }
             case OperandLifeTime::CONSTANT_POOL: {
+                if (operand.location.poolIndex >= memoryPools.size()) {
+                    *errorStatus = ErrorStatus::INVALID_ARGUMENT;
+                    return nullptr;
+                }
                 resultModel.setOperandValueFromMemory(
                         i, memoryPools[operand.location.poolIndex].get(), operand.location.offset,
                         operand.location.length);