CVE-2021-37681: NPE in TFLite

(updated )

The implementation of SVDF in TFLite is vulnerable to a null pointer error:

TfLiteTensor* state = GetVariableInput(context, node, kStateTensor);
// ...
GetTensorData<float>(state)

The GetVariableInput function can return a null pointer but GetTensorData assumes that the argument is always a valid tensor.

TfLiteTensor* GetVariableInput(TfLiteContext* context, const TfLiteNode* node,
int index) {
TfLiteTensor* tensor = GetMutableInput(context, node, index);
return tensor->is_variable ? tensor : nullptr;
}

Furthermore, because GetVariableInput calls GetMutableInput which might return nullptr, the tensor->is_variable expression can also trigger a null pointer exception.

References

Code Behaviors & Features

Detect and mitigate CVE-2021-37681 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →