commit 76dff74e1d9cbbdebd927bb40433b50623d4281c
author Przemysław Szczepaniak <pszczepaniak@google.com> Mon Mar 13 14:54:47 2023 +0000
committer Fairphone ODM <fairphone-odm@localhost> Tue Dec 19 14:07:49 2023 +0800
tree 32bc44852464c1ea447d738a28cceeec2931cb1b
parent 0430a193175e5adf1bb769d3fdfac4dc1b6623bf

Fix OOB Read in convertSubgraphFromHAL

Bug: 269271098
Test: Run the POC
(cherry picked from https://android-review.googlesource.com/q/commit:029b72665f6c7c262255ad7475d4be9fc58d9db0)
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:22a20c01cc01dbb36ecbc68e664a070c4ffad2cf)
Merged-In: I7a5f3780fafd12663693b74988baee6a9188041f
Change-Id: I7a5f3780fafd12663693b74988baee6a9188041f
(cherry picked from commit 9fc00b621cd07799f01aeeaf958c76b4a48ae0f8)

shim_and_sl/ShimConverter.cpp

diff --git a/shim_and_sl/ShimConverter.cpp b/shim_and_sl/ShimConverter.cpp
index 4830c5d..9914af1 100644
--- a/shim_and_sl/ShimConverter.cpp
+++ b/shim_and_sl/ShimConverter.cpp
@@ -51,6 +51,10 @@
         size_t subgraphIndex, const std::vector<uint8_t>& copiedOperandValues,
         ErrorStatus* errorStatus) {
     *errorStatus = ErrorStatus::NONE;
+    if (allModels == nullptr || subgraphIndex >= (*allModels).size()) {
+        *errorStatus = ErrorStatus::INVALID_ARGUMENT;
+        return nullptr;
+    }
     if ((*allModels)[subgraphIndex].has_value()) {
         return (*allModels)[subgraphIndex]->getHandle();
     }