tensorflow/lite/kernels: Prevent an OOB read in expand_dims.cc

npt-1707 · npt-1707 · commit 9dc1f44e9d6c · 2025-05-09T03:53:20.000+08:00
Signed-off-by: npt-1707 &lt;npthanh132@gmail.com&gt;
diff --git a/tensorflow/lite/kernels/expand_dims.cc b/tensorflow/lite/kernels/expand_dims.cc
@@ -38,6 +38,7 @@ TfLiteStatus ExpandTensorDim(TfLiteContext* context, const TfLiteTensor& input,
     axis = input_dims.size + 1 + axis;
   }
   TF_LITE_ENSURE(context, axis <= input_dims.size);
+  TF_LITE_ENSURE(context, axis >= 0);
 
   TfLiteIntArray* output_dims = TfLiteIntArrayCreate(input_dims.size + 1);
   for (int i = 0; i < output_dims->size; ++i) {

Original file line number	Diff line number	Diff line change
`@@ -38,6 +38,7 @@ TfLiteStatus ExpandTensorDim(TfLiteContext* context, const TfLiteTensor& input,`
`38`	`38`	`axis = input_dims.size + 1 + axis;`
`39`	`39`	`}`
`40`	`40`	`TF_LITE_ENSURE(context, axis <= input_dims.size);`
	`41`	`+ TF_LITE_ENSURE(context, axis >= 0);`
`41`	`42`
`42`	`43`	`TfLiteIntArray* output_dims = TfLiteIntArrayCreate(input_dims.size + 1);`
`43`	`44`	`for (int i = 0; i < output_dims->size; ++i) {`