Skip to content

Commit cb8eb87

Browse files
lucylqfacebook-github-bot
authored andcommitted
Fix stack buffer overflow in resize_tensor (#15626)
Summary: `new_sizes_casted` is created with size kTensorDimensionLimit. Make sure that new_sizes_ndim is <= kTensorDimensionLimit before resizing. Reviewed By: JacobSzwejbka Differential Revision: D86361111
1 parent b005f10 commit cb8eb87

File tree

1 file changed

+6
-0
lines changed

1 file changed

+6
-0
lines changed

runtime/core/exec_aten/util/tensor_util.h

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1212,6 +1212,12 @@ ET_NODISCARD inline Error resize_tensor(
12121212
std::array<executorch::aten::SizesType, kTensorDimensionLimit>
12131213
new_sizes_casted{};
12141214
size_t new_sizes_ndim = new_sizes.size();
1215+
ET_CHECK_OR_RETURN_ERROR(
1216+
new_sizes_ndim <= kTensorDimensionLimit,
1217+
InvalidArgument,
1218+
"new_sizes_ndim %zu is greater than kTensorDimensionLimit %zu",
1219+
new_sizes_ndim,
1220+
kTensorDimensionLimit);
12151221
for (const auto i : c10::irange(new_sizes_ndim)) {
12161222
new_sizes_casted[i] =
12171223
static_cast<executorch::aten::SizesType>(new_sizes[i]);

0 commit comments

Comments
 (0)