Add bounds check in AddSingleValueAndAdvance to prevent OOB read from empty repeated fields - #4147
Open
shaggyinsomniac wants to merge 1 commit into
Open
Conversation
When --enable_serialization_as_tensor_content is set, output tensors are serialized via AsProtoTensorContent, placing data in tensor_content and leaving the typed repeated fields (float_val, int_val, etc.) empty. The REST handler's AddSingleValueAndAdvance then calls tensor.float_val(*offset) etc. unconditionally. Protobuf's RepeatedField::Get uses DCHECK, compiled out in release builds, causing an OOB read (uninitialized heap value written into the JSON response) or nullptr dereference (SIGSEGV killing the server). Fix: check that *offset is within the repeated field's size() before calling Get(), returning an InvalidArgument error instead.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
When
--enable_serialization_as_tensor_contentis set (a documented performance flag, model_servers/main.cc:312), output tensors are serialized viaAsProtoTensorContent(predict_util.cc:185), placing data inTensorProto.tensor_contentand leaving the typed repeated fields (float_val,int_val, etc.) empty.The REST handler then serializes via
MakeJsonFromTensors(http_rest_api_handler.cc:176) whoseAddSingleValueAndAdvance(json_tensor.cc:888+) callstensor.float_val(*offset)etc. unconditionally.Protobuf's
RepeatedField::Get(index)uses DCHECK — compiled out in release builds. On an empty repeated field:Get(0)reads uninitialized heap memory → written into the JSON response body (heap disclosure)Fix
Add a bounds check before the switch statement: compute the repeated field's
size()for the tensor's dtype and verify*offset < size. If out of bounds, returnInvalidArgumentwith a descriptive message instead of indexing OOB.Verification
Reproduced in a C++ release build (protobuf 36, -O2 -DNDEBUG): a
TensorProtowithtensor_contentset andfloat_valempty; callingfloat_val(0)(the exact indexing the REST writer performs) returns garbage from uninitialized memory. With this fix, the call returns anInvalidArgumenterror.Reported via Google Bug Hunters (issue 553430318).