CVE-2022-23558: Integer overflow in TFLite array creation

(updated )

An attacker can craft a TFLite model that would cause an integer overflow in TfLiteIntArrayCreate:

TfLiteIntArray* TfLiteIntArrayCreate(int size) {
int alloc_size = TfLiteIntArrayGetSizeInBytes(size);
// ...
TfLiteIntArray* ret = (TfLiteIntArray*)malloc(alloc_size);
// ...
}

The TfLiteIntArrayGetSizeInBytes returns an int instead of a size_t:

int TfLiteIntArrayGetSizeInBytes(int size) {
static TfLiteIntArray dummy;

int computed_size = sizeof(dummy) + sizeof(dummy.data[0]) * size;

References

Code Behaviors & Features

Detect and mitigate CVE-2022-23558 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →