已开启
Fix CVE-2022-23590 #127
XingSongSun创建于 6月2日
Fix CVE-2022-23590 #127
已开启
共 2 个文件变更+33-2
| @@ -0,0 +1,27 @@ | |||
| 1 | +From 955059813cc325dc1db5e2daa6221271406d4439 Mon Sep 17 00:00:00 2001 | ||
| 2 | +From: Dan Moldovan <mdan@google.com> | ||
| 3 | +Date: Fri, 12 Nov 2021 08:17:57 -0800 | ||
| 4 | +Subject: [PATCH] Check for type inference error on node construction. | ||
| 5 | + | ||
| 6 | +PiperOrigin-RevId: 409415804 | ||
| 7 | +Change-Id: Ieb6e020906b96f522bf8e2fa103715ddbbdc434a | ||
| 8 | +--- | ||
| 9 | + tensorflow/core/graph/graph.cc | 5 +++++ | ||
| 10 | + 1 file changed, 5 insertions(+) | ||
| 11 | + | ||
| 12 | +diff --git a/tensorflow/core/graph/graph.cc b/tensorflow/core/graph/graph.cc | ||
| 13 | +index 397a45c97737ab..2e3703b66030f4 100644 | ||
| 14 | +--- a/tensorflow/core/graph/graph.cc | ||
| 15 | ++++ b/tensorflow/core/graph/graph.cc | ||
| 16 | + Node* Graph::AddNode(NodeDef node_def, Status* status) { | ||
| 17 | + VLOG(3) << "AddNode: found type constructor for " << node_def.name(); | ||
| 18 | + const auto ctor_type = | ||
| 19 | + full_type::SpecializeType(AttrSlice(node_def), op_reg_data->op_def); | ||
| 20 | ++ if (!ctor_type.ok()) { | ||
| 21 | ++ *status = errors::InvalidArgument("type error: ", | ||
| 22 | ++ ctor_type.status().ToString()); | ||
| 23 | ++ return nullptr; | ||
| 24 | ++ } | ||
| 25 | + const FullTypeDef ctor_typedef = ctor_type.ValueOrDie(); | ||
| 26 | + if (ctor_typedef.type_id() != TFT_UNSET) { | ||
| 27 | + *(node_def.mutable_experimental_type()) = ctor_typedef; | ||
| @@ -1,7 +1,7 @@ | |||
| 1 | %global _empty_manifest_terminate_build 0 | 1 | %global _empty_manifest_terminate_build 0 |
| 2 | Name: tensorflow | 2 | Name: tensorflow |
| 3 | Version: 2.12.1 | 3 | Version: 2.12.1 |
| 4 | -Release: 5 | 4 | +Release: 6 |
| 5 | Summary: An Open Source Machine Learning Framework for Everyone | 5 | Summary: An Open Source Machine Learning Framework for Everyone |
| 6 | License: Apache License 2.0 | 6 | License: Apache License 2.0 |
| 7 | URL: https://www.tensorflow.org/ | 7 | URL: https://www.tensorflow.org/ |
| @@ -17,6 +17,7 @@ Patch1000: aarch64_external_files.patch | |||
| 17 | %endif | 17 | %endif |
| 18 | %ifarch riscv64 | 18 | %ifarch riscv64 |
| 19 | Patch1100: riscv64_external_files.patch | 19 | Patch1100: riscv64_external_files.patch |
| 20 | +Patch1101: backport-CVE-2022-23590.patch | ||
| 20 | %endif | 21 | %endif |
| 21 | Requires: python3-future python3-numpy python3-six python3-astunparse python3-google-pasta python3-opt-einsum | 22 | Requires: python3-future python3-numpy python3-six python3-astunparse python3-google-pasta python3-opt-einsum |
| 22 | Requires: python3-typing-extensions python3-wrapt python3-h5py python3-protobuf python3-grpcio python3-absl-py | 23 | Requires: python3-typing-extensions python3-wrapt python3-h5py python3-protobuf python3-grpcio python3-absl-py |
| @@ -45,6 +46,7 @@ TensorFlow provides stable Python and C++ APIs, as well as non-guaranteed backwa | |||
| 45 | 46 | ||
| 46 | %prep | 47 | %prep |
| 47 | %setup -n %{name}-%{version} | 48 | %setup -n %{name}-%{version} |
| 49 | +%patch -P 1101 -p1 | ||
| 48 | %patch 0 -p1 | 50 | %patch 0 -p1 |
| 49 | %patch 1 -p1 | 51 | %patch 1 -p1 |
| 50 | %patch 2 -p1 | 52 | %patch 2 -p1 |
| @@ -84,6 +86,8 @@ bazel --output_user_root=`pwd`/../output_user_root build --nofetch --host_copt=- | |||
| 84 | %{_bindir}/* | 86 | %{_bindir}/* |
| 85 | 87 | ||
| 86 | %changelog | 88 | %changelog |
| 89 | +* Tue Jun 02 2026 sunwenhan <sunwenhan@xfusion.com> - 2.12.1-6 | ||
| 90 | +- Fix CVE-2022-23590 | ||
| 87 | * Tue Mar 03 2026 megranate wangkunjie@xfuison.com - 2.12.1-5 | 91 | * Tue Mar 03 2026 megranate wangkunjie@xfuison.com - 2.12.1-5 |
| 88 | - fix CVE-2026-2492 | 92 | - fix CVE-2026-2492 |
| 89 | 93 | ||
| @@ -122,4 +126,4 @@ bazel --output_user_root=`pwd`/../output_user_root build --nofetch --host_copt=- | |||
| 122 | - fix some cves | 126 | - fix some cves |
| 123 | 127 | ||
| 124 | * Wed Sep 30 2020 Zhipeng Xie<xiezhipeng1@huawei.com> - 2.3.1-1 | 128 | * Wed Sep 30 2020 Zhipeng Xie<xiezhipeng1@huawei.com> - 2.3.1-1 |
| 125 | -- Package init | 129 | +- Package init |