Skip to content

Commit d48711e

Browse files
lucylqfacebook-github-bot
authored andcommitted
Add checks for compute_slice
Summary: Add safety checks to compute_slice, to ensure that we: 1. Do not read outside of the src tensor bounds 2. Do not write outside of the output tensor bounds Differential Revision: D86433966
1 parent 27c48b9 commit d48711e

File tree

1 file changed

+17
-0
lines changed

1 file changed

+17
-0
lines changed

kernels/portable/cpu/util/slice_util.cpp

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -156,6 +156,19 @@ void compute_slice(
156156
int64_t length,
157157
int64_t step,
158158
Tensor& out) {
159+
160+
ET_CHECK_MSG(
161+
dim < in.dim(),
162+
"Requested dim is larger than input tensor dim; dim = %" PRId64, dim
163+
);
164+
ET_CHECK_MSG(
165+
start < dim,
166+
"Requested start is larger than the dim size."
167+
);
168+
ET_CHECK_MSG(
169+
length * step < dim,
170+
"Requested length * step is larger than the dim size."
171+
);
159172
size_t dim_length = in.size(dim);
160173

161174
size_t leading_dims = getLeadingDims(in, dim);
@@ -170,6 +183,10 @@ void compute_slice(
170183
const char* input_data = in.const_data_ptr<char>();
171184
char* dest = out.mutable_data_ptr<char>();
172185

186+
ET_CHECK_MSG(
187+
out.nbytes() >= (length * leading_dims * length_per_step),
188+
"out.nbytes() is smaller than the expected slice size."
189+
);
173190
for (const auto i : c10::irange(leading_dims)) {
174191
const char* src = input_data + (i * dim_length + start) * length_per_step;
175192
for ([[maybe_unused]] const auto j : c10::irange(length)) {

0 commit comments

Comments
 (0)