commit 996176dbbc815ea5681b352c7d5cbc11d8ced106
author Przemyslaw Szczepaniak <pszczepaniak@google.com> Tue Mar 28 14:39:24 2023 +0000
committer Gerrit Code Review <noreply-gerritcodereview@google.com> Tue Mar 28 14:39:24 2023 +0000
tree 1df2e2836e1817b732d7701cf483513b26dfa3b6
parent b6dd3ef24fbdfa7325e6267d8b48070f461dc7fd
parent 029b72665f6c7c262255ad7475d4be9fc58d9db0

Merge "Fix OOB Read in convertSubgraphFromHAL"

shim_and_sl/ShimConverter.cpp

diff --git a/shim_and_sl/ShimConverter.cpp b/shim_and_sl/ShimConverter.cpp
index 46a05ab..ed3cda2 100644
--- a/shim_and_sl/ShimConverter.cpp
+++ b/shim_and_sl/ShimConverter.cpp
@@ -132,6 +132,12 @@
 
         switch (operand.lifetime) {
             case OperandLifeTime::CONSTANT_COPY: {
+                if (operand.location.length + operand.location.offset >
+                    model.operandValues.size()) {
+                    *errorStatus = ErrorStatus::INVALID_ARGUMENT;
+                    return nullptr;
+                }
+
                 if (operand.location.length <=
                     ANEURALNETWORKS_MAX_SIZE_OF_IMMEDIATELY_COPIED_VALUES) {
                     resultModel.setOperandValue(