Ai
1 Star 0 Fork 57

gice/tensorflow

forked from openEuler-RISC-V/tensorflow
关闭
 
加入 Gitee
与超过 1200万 开发者一起发现、参与优秀开源项目,私有仓库也完全免费 :)
免费加入
文件
该仓库未声明开源许可证文件(LICENSE),使用请关注具体项目描述及其代码上游依赖。
克隆/下载
CVE-2021-37637.patch 2.69 KB
一键复制 编辑 原始数据 按行查看 历史
From 5dc7f6981fdaf74c8c5be41f393df705841fb7c5 Mon Sep 17 00:00:00 2001
From: "A. Unique TensorFlower" <gardener@tensorflow.org>
Date: Fri, 14 May 2021 22:07:07 -0700
Subject: [PATCH] Fix accessing possible nullptr in
tensorflow::data::CompressElement and UncompressElement which are used in
tf.data.service.
PiperOrigin-RevId: 373920841
Change-Id: Ia88d78aee09fa19bb53a0f163fd19620d0c68743
---
tensorflow/core/data/compression_utils.cc | 22 +++++++++++++++-------
1 file changed, 15 insertions(+), 7 deletions(-)
diff --git a/tensorflow/core/data/compression_utils.cc b/tensorflow/core/data/compression_utils.cc
index bbff3a96667d1..40238a05a2614 100644
--- a/tensorflow/core/data/compression_utils.cc
+++ b/tensorflow/core/data/compression_utils.cc
@@ -29,9 +29,10 @@ Status CompressElement(const std::vector<Tensor>& element,
int64 total_size = 0;
for (auto& component : element) {
if (DataTypeCanUseMemcpy(component.dtype())) {
- // Some datatypes can be memcopied, allowing us to save two copies
- // (AsProtoTensorContent and SerializeToArray).
- total_size += DMAHelper::buffer(&component)->size();
+ const TensorBuffer* buffer = DMAHelper::buffer(&component);
+ if (buffer) {
+ total_size += buffer->size();
+ }
} else {
non_memcpy_components.emplace_back();
component.AsProtoTensorContent(&non_memcpy_components.back());
@@ -53,8 +54,10 @@ Status CompressElement(const std::vector<Tensor>& element,
component.shape().AsProto(metadata->mutable_tensor_shape());
if (DataTypeCanUseMemcpy(component.dtype())) {
const TensorBuffer* buffer = DMAHelper::buffer(&component);
- memcpy(position, buffer->data(), buffer->size());
- metadata->set_tensor_size_bytes(buffer->size());
+ if (buffer) {
+ memcpy(position, buffer->data(), buffer->size());
+ metadata->set_tensor_size_bytes(buffer->size());
+ }
} else {
TensorProto& proto = non_memcpy_components[non_memcpy_component_index++];
proto.SerializeToArray(position, proto.ByteSizeLong());
@@ -94,8 +97,13 @@ Status UncompressElement(const CompressedElement& compressed,
if (DataTypeCanUseMemcpy(metadata.dtype())) {
out->emplace_back(metadata.dtype(), metadata.tensor_shape());
TensorBuffer* buffer = DMAHelper::buffer(&out->back());
- iov[i].iov_base = buffer->data();
- iov[i].iov_len = buffer->size();
+ if (buffer) {
+ iov[i].iov_base = buffer->data();
+ iov[i].iov_len = buffer->size();
+ } else {
+ iov[i].iov_base = nullptr;
+ iov[i].iov_len = 0;
+ }
} else {
// Allocate an empty Tensor. We will fill it out later after
// uncompressing into the tensor_proto_str.
Loading...
马建仓 AI 助手
尝试更多
代码解读
代码找茬
代码优化
1
https://gitee.com/gice/tensorflow.git
git@gitee.com:gice/tensorflow.git
gice
tensorflow
tensorflow
master

搜索帮助