Bounds-check scatter indices in the WASM backend - #8743
Open
shaggyinsomniac wants to merge 1 commit into
Open
Conversation
The wasm scatter kernels computed an output pointer directly from attacker-controlled index values with no range validation, so an out-of-range index (including a negative one, which sign-extends) wrote outside the output allocation in wasm linear memory. The CPU backend throws 'Invalid indices' for the same inputs. Validate indices in the ScatterNd/TensorScatterUpdate wrappers before entering wasm, matching the CPU backend's error, and guard the C++ kernels as defense in depth. Mirrors the CropAndResize bounds fix.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The WASM scatter kernels compute an output pointer directly from the caller's index values with no range validation, so an out-of-range index writes outside the output allocation in wasm linear memory. A negative index wraps around and writes before the allocation. The CPU backend throws an error for the same inputs, so the backends are also inconsistent:
This change validates indices in the ScatterNd and TensorScatterUpdate wrappers before entering wasm, throwing the same error as the CPU backend, and adds bounds guards in the C++ kernels as defense in depth. Same validation-gap class as #8730 (WASM CropAndResize), but on the write side.
Added a test in index_test.ts mirroring the placement of the CropAndResize test.