Skip to content

litert/xnnpack: reject negative begin-tensor shape dimension in SliceOperation::ToXnnpack() - #11138

Open
destro4evr-rgb wants to merge 1 commit into
google:masterfrom
destro4evr-rgb:fix/litert-slice-negative-begin-shape
Open

litert/xnnpack: reject negative begin-tensor shape dimension in SliceOperation::ToXnnpack()#11138
destro4evr-rgb wants to merge 1 commit into
google:masterfrom
destro4evr-rgb:fix/litert-slice-negative-begin-shape

Conversation

@destro4evr-rgb

@destro4evr-rgb destro4evr-rgb commented Sep 4, 2026

Copy link
Copy Markdown
Contributor

Problem

PR #11056 added a guard for the 0D scalar case (begin_info.shape.empty()). A 1D begin tensor whose sole dimension is negative (e.g. -1, valid in the flatbuffer format as a dynamic/unknown size marker) bypasses that guard:

if (begin_info.shape.empty()) { ... }   // shape = [-1] → NOT empty, bypassed
size_t num_dims = begin_info.shape[0];  // -1 (int32_t) → SIZE_MAX (size_t)

std::vector<size_t> offsets(num_dims); // requests SIZE_MAX elements → abort
std::vector<size_t> sizes(num_dims);   // same

shape[0] = -1 wraps to SIZE_MAX on the implicit int32_t → size_t conversion. Both vector constructors then request SIZE_MAX elements, exceeding max_size() and causing an unconditional abort at model-load time - before any inference occurs.

Fix

Extend the existing guard to also reject shape[0] <= 0:

if (begin_info.shape.empty() || begin_info.shape[0] <= 0) {
  return absl::InvalidArgumentError(...);
}

…Operation::ToXnnpack()

The existing guard added by PR google#11056 only rejects a 0D begin tensor
(begin_info.shape.empty()). A 1D begin tensor whose sole dimension is
negative (e.g. -1 for a dynamic/unknown size) bypasses that guard:
shape.empty() returns false, shape[0] = -1 is read, and the implicit
int32_t -> size_t conversion produces SIZE_MAX. The two
std::vector<size_t> allocations that follow request SIZE_MAX elements,
exceeding max_size() and causing an unconditional abort at model-load time.

Extend the guard to also reject shape[0] <= 0.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant