Skip to content

Validate output size in FILTER_BANK_LOG kernel#3603

Open
adilburaksen wants to merge 1 commit into
tensorflow:mainfrom
adilburaksen:fix-filterbanklog-output-oob
Open

Validate output size in FILTER_BANK_LOG kernel#3603
adilburaksen wants to merge 1 commit into
tensorflow:mainfrom
adilburaksen:fix-filterbanklog-output-oob

Conversation

@adilburaksen

Copy link
Copy Markdown

BUG=out-of-bounds write in FILTER_BANK_LOG kernel from unchecked output size

What

FilterBankLogEval takes num_channels from the input tensor
(num_channels = input->dims->data[0]) and FilterbankLog writes num_channels
elements to the output:

for (int i = 0; i < num_channels; ++i) { output[i] = ...; }

FilterBankLogPrepare validated only the rank and type of the input and output
tensors — never that the output is at least as large as the input. A model whose
FILTER_BANK_LOG output tensor is smaller than its input therefore causes an
out-of-bounds write (e.g. input of 32 elements, output of 1), confirmed with
AddressSanitizer:

ERROR: AddressSanitizer: stack-buffer-overflow  WRITE of size 2
  #0 tflite::tflm_signal::FilterbankLog(...)  signal/src/filter_bank_log.cc
  #1 tflite::FilterBankLogEval(...)           signal/micro/kernels/filter_bank_log.cc:97
  #2 tflite::micro::KernelRunner::Invoke()

Change

  • filter_bank_log.cc: FilterBankLogPrepare now requires
    ElementCount(output) >= ElementCount(input).
  • filter_bank_log_test.cc: regression test that the mismatched model is rejected.

No change for valid models.

FilterBankLogEval derives num_channels from the input tensor and FilterbankLog
writes that many elements to the output. FilterBankLogPrepare checked only the
rank and type of the input and output, never that the output has at least as
many elements as the input, so a model whose output tensor is smaller than its
input caused an out-of-bounds write (confirmed with AddressSanitizer).

Add an output-size check in FilterBankLogPrepare and a regression test.
@adilburaksen adilburaksen requested a review from a team as a code owner June 18, 2026 23:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant