commit f3aaec2b0e9f645aff9665b3d91fa83d6c5d31bc
author Ian Hua <ianhua@google.com> Thu Jul 06 10:05:36 2023 +0000
committer Fairphone ODM <fairphone-odm@localhost> Thu Aug 31 16:36:01 2023 +0800
tree 3224c23668073151ba7a8ca452d0c3bb361c0592
parent f71b53a90b6b431bcbe381eb9e7ddf94ed09e1c1

Fix out of Bounds Read in convertSubgraphFromHAL in ShimConverter.cpp in libneuralnetworks_shim_static

Bug: 269270167
Test: N/A
(cherry picked from commit 4bf7bb6b50b412678a681d29f7ced70a4d737762)
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:6e1bbe89e08936a1cad152a59ae82a3773c51cca)
Merged-In: I33272284b965efcbb531f64cbf838a0d59c28e00
Change-Id: I33272284b965efcbb531f64cbf838a0d59c28e00
(cherry picked from commit cec5090c59edb2acb30c05febeeaad9a264f2e0e)

shim_and_sl/ShimConverter.cpp

diff --git a/shim_and_sl/ShimConverter.cpp b/shim_and_sl/ShimConverter.cpp
index b0f914c..b8619d0 100644
--- a/shim_and_sl/ShimConverter.cpp
+++ b/shim_and_sl/ShimConverter.cpp
@@ -150,6 +150,10 @@
                 break;
             }
             case OperandLifeTime::CONSTANT_POOL: {
+                if (operand.location.poolIndex >= memoryPools.size()) {
+                    *errorStatus = ErrorStatus::INVALID_ARGUMENT;
+                    return nullptr;
+                }
                 resultModel.setOperandValueFromMemory(
                         i, memoryPools[operand.location.poolIndex].get(), operand.location.offset,
                         operand.location.length);