Headline
CVE-2022-23572: Properly handle the case where `SpecializeType()` returns an error `S… · tensorflow/tensorflow@cb16478
Tensorflow is an Open Source Machine Learning Framework. Under certain scenarios, TensorFlow can fail to specialize a type during shape inference. This case is covered by the DCHECK function however, DCHECK is a no-op in production builds and an assertion failure in debug builds. In the first case execution proceeds to the ValueOrDie line. This results in an assertion failure as ret contains an error Status, not a value. In the second case we also get a crash due to the assertion failure. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, and TensorFlow 2.6.3, as these are also affected and still in supported range.
Permalink
Browse files
Properly handle the case where SpecializeType() returns an error `S…
…tatus`.
If the error case in `SpecializeType()` is reached, then we would get a crash when trying to access the value of an errorenous `StatusOr` object
PiperOrigin-RevId: 408380069 Change-Id: If3c3fc876dcf9384d5ec7a4985adc68c23ea7318
- Loading branch information
1 parent c2b31ff commit cb164786dc891ea11d3a900e90367c339305dc7b
Showing with 4 additions and 1 deletion.
- +4 −1 tensorflow/core/framework/shape_inference.cc
@@ -170,7 +170,10 @@ void InferenceContext::PreInputInit(
const std::vector<ShapeHandle>& input_tensors_as_shapes) {
// TODO(mdan): This is also done at graph construction. Run only here instead?
const auto ret = full_type::SpecializeType(attrs_, op_def);
DCHECK(ret.status().ok()) << "while instantiating types: " << ret.status();
if (!ret.status().ok()) {
construction_status_ = ret.status();
return;
}
ret_types_ = ret.ValueOrDie();
input_tensors_ = input_tensors;
0 comments on commit cb16478
Please sign in to comment.