commit db71a0726b9b21c8e7fd55b0516a5d0d016e4468
author Ian Hua <ianhua@google.com> Thu Jul 06 10:05:36 2023 +0000
committer Android Build Coastguard Worker <android-build-coastguard-worker@google.com> Tue Jul 18 04:32:31 2023 +0000
tree d6174d70d84fd677dc24f79140246ff0a043b7ac
parent 4fbddb538aecb5cf61c63fb32a304c7768b8fd1f

Fix out of Bounds Read in convertSubgraphFromHAL in ShimConverter.cpp in libneuralnetworks_shim_static

Bug: 269270167
Test: N/A
(cherry picked from commit 4bf7bb6b50b412678a681d29f7ced70a4d737762)
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:0c8e63a0757eabcde79138fdec3022cd4d3993a1)
Merged-In: I33272284b965efcbb531f64cbf838a0d59c28e00
Change-Id: I33272284b965efcbb531f64cbf838a0d59c28e00

shim_and_sl/ShimConverter.cpp

diff --git a/shim_and_sl/ShimConverter.cpp b/shim_and_sl/ShimConverter.cpp
index ed3cda2..9914af1 100644
--- a/shim_and_sl/ShimConverter.cpp
+++ b/shim_and_sl/ShimConverter.cpp
@@ -154,6 +154,10 @@
                 break;
             }
             case OperandLifeTime::CONSTANT_POOL: {
+                if (operand.location.poolIndex >= memoryPools.size()) {
+                    *errorStatus = ErrorStatus::INVALID_ARGUMENT;
+                    return nullptr;
+                }
                 resultModel.setOperandValueFromMemory(
                         i, memoryPools[operand.location.poolIndex].get(), operand.location.offset,
                         operand.location.length);