CVE-2022-29202: Missing input validation on `tf.ragged.constant` · Issue #55199 · tensorflow/tensorflow

Please make sure that this is a bug. As per our
GitHub Policy,
we only address code/doc bugs, performance issues, feature requests and
build/installation issues on GitHub. tag:bug_template

System information

• Have I written custom code (as opposed to using a stock example script provided in TensorFlow): yes
• OS Platform and Distribution (e.g., Linux Ubuntu 16.04):
• Mobile device (e.g. iPhone 8, Pixel 2, Samsung Galaxy) if the issue happens on mobile device:
• TensorFlow installed from (source or binary):
• TensorFlow version (use command below):2.8.0
• Python version: 3.7.12
• Bazel version (if compiling from source):
• GCC/Compiler version (if compiling from source):
• CUDA/cuDNN version: using a colab notebook
• GPU model and memory: using a colab notebook

You can collect some of this information using our environment capture
script
You can also obtain the TensorFlow version with:

1. TF 1.0: python -c "import tensorflow as tf; print(tf.GIT_VERSION, tf.VERSION)"
2. TF 2.0: python -c "import tensorflow as tf; print(tf.version.GIT_VERSION, tf.version.VERSION)"

Describe the current behavior

If I pass an empty list with a large ragged_rank to tf.ragged.constant,
all RAM is consumed, causing the notebook to crash.
The docs indicate that ragged_rank should be between 0 and the rank of pylist, so the large value of ragged_rank should be rejected

Describe the expected behavior

Some input validation should be done and an exception thrown.

Contributing

• Do you want to contribute a PR? (yes/no):
• Briefly describe your candidate solution(if contributing):

Standalone code to reproduce the issue
Provide a reproducible test case that is the bare minimum necessary to generate
the problem. If possible, please share a link to Colab/Jupyter/any notebook.
The colab notebook:
https://colab.research.google.com/drive/1OyQNTCiqHKjmHKfYbSOmVt4EfkLEgsNA?usp=sharing

import tensorflow as tf
tf.ragged.constant(pylist=[],ragged_rank=8968073515812833920)

Other info / logs Include any logs or source code that would be helpful to
diagnose the problem. If including tracebacks, please include the full
traceback. Large logs and files should be attached.