CVE-2022-41896: Make MfccMelFilterbank fail initialization if num_channels is > max i… · tensorflow/tensorflow@39ec7ea

@@ -15,6 +15,7 @@ limitations under the License.

#include “tensorflow/core/kernels/mfcc_mel_filterbank.h”

#include <limits>

#include <vector>

#include “tensorflow/core/platform/test.h”

@@ -85,4 +86,37 @@ TEST(MfccMelFilterbankTest, IgnoresExistingContentOfOutputVector) {

}

}

TEST(MfccMelFilterbankTest, FailsWhenChannelsGreaterThanMaxIntValue) {

// Test for bug where vector throws a length_error when it suspects the size

// to be more than it’s max_size. For now, we fail initialization when the

// number of requested channels is >= the maximum value int can take (since

// num_channels_ is an int).

MfccMelFilterbank filterbank;

const int kSampleCount = 513;

std::size_t num_channels = std::numeric_limits<int>::max();

bool initialized = filterbank.Initialize(

kSampleCount, 2 /* sample rate */, num_channels /* channels */,

1.0 /* lower frequency limit */, 5.0 /* upper frequency limit */);

EXPECT_FALSE(initialized);

}

TEST(MfccMelFilterbankTest, FailsWhenChannelsGreaterThanMaxSize) {

// Test for bug where vector throws a length_error when it suspects the size

// to be more than it’s max_size. For now, we fail initialization when the

// number of requested channels is > than std::vector<double>::max_size().

MfccMelFilterbank filterbank;

const int kSampleCount = 513;

// Set num_channels to exceed the max_size a double vector can

// theoretically take.

std::size_t num_channels = std::vector<double>().max_size() + 1;

bool initialized = filterbank.Initialize(

kSampleCount, 2 /* sample rate */, num_channels /* channels */,

1.0 /* lower frequency limit */, 5.0 /* upper frequency limit */);

EXPECT_FALSE(initialized);

}

} // namespace tensorflow