已开启
Fix CVE-2021-41199 #130
XingSongSun创建于 6月2日
Fix CVE-2021-41199 #130
已开启
共 2 个文件变更+70-2
| @@ -0,0 +1,64 @@ | |||
| 1 | +From 660ad5e76d8df64d855f77b5e2e39d8ddb40cab5 Mon Sep 17 00:00:00 2001 | ||
| 2 | +From: Yong Tang <yong.tang.github@outlook.com> | ||
| 3 | +Date: Sun, 15 Aug 2021 04:22:00 +0000 | ||
| 4 | +Subject: [PATCH] Fix crash with tf.image.resize if size is large | ||
| 5 | + | ||
| 6 | +This PR tries to address the issue raised in 46914 where | ||
| 7 | +tf.image.resize will crash if size is large, (implicitly | ||
| 8 | +causes tf.keras.layers.UpSampling2D to crash). | ||
| 9 | + | ||
| 10 | +This PR adds necessary shape overflow check to prevent | ||
| 11 | +crash. | ||
| 12 | + | ||
| 13 | +This PR fixes 46914. | ||
| 14 | + | ||
| 15 | +Signed-off-by: Yong Tang <yong.tang.github@outlook.com> | ||
| 16 | +--- | ||
| 17 | + tensorflow/core/util/image_resizer_state.h | 12 +++++++++--- | ||
| 18 | + tensorflow/python/ops/image_ops_test.py | 8 ++++++++ | ||
| 19 | + 2 files changed, 17 insertions(+), 3 deletions(-) | ||
| 20 | + | ||
| 21 | +diff --git a/tensorflow/core/util/image_resizer_state.h b/tensorflow/core/util/image_resizer_state.h | ||
| 22 | +index 31764bdd87976d..2cb5715260ed85 100644 | ||
| 23 | +--- a/tensorflow/core/util/image_resizer_state.h | ||
| 24 | ++++ b/tensorflow/core/util/image_resizer_state.h | ||
| 25 | + struct ImageResizerState { | ||
| 26 | + void ValidateAndCreateOutput(OpKernelContext* context) { | ||
| 27 | + ValidateAndCalculateOutputSize(context); | ||
| 28 | + if (!context->status().ok()) return; | ||
| 29 | ++ | ||
| 30 | ++ TensorShape shape; | ||
| 31 | ++ // Guard against shape overflow | ||
| 32 | ++ OP_REQUIRES_OK(context, shape.AddDimWithStatus(batch_size)); | ||
| 33 | ++ OP_REQUIRES_OK(context, shape.AddDimWithStatus(out_height)); | ||
| 34 | ++ OP_REQUIRES_OK(context, shape.AddDimWithStatus(out_width)); | ||
| 35 | ++ OP_REQUIRES_OK(context, shape.AddDimWithStatus(channels)); | ||
| 36 | ++ | ||
| 37 | + OP_REQUIRES_OK( | ||
| 38 | + context, | ||
| 39 | +- context->allocate_output( | ||
| 40 | +- 0, TensorShape({batch_size, out_height, out_width, channels}), | ||
| 41 | +- &output)); | ||
| 42 | ++ context->allocate_output( 0, shape, &output)); | ||
| 43 | + } | ||
| 44 | + | ||
| 45 | + int64_t batch_size; | ||
| 46 | +diff --git a/tensorflow/python/ops/image_ops_test.py b/tensorflow/python/ops/image_ops_test.py | ||
| 47 | +index d589c7525b0ece..2eb82a213f5152 100644 | ||
| 48 | +--- a/tensorflow/python/ops/image_ops_test.py | ||
| 49 | ++++ b/tensorflow/python/ops/image_ops_test.py | ||
| 50 | + def testPreserveAspectRatioSquare(self): | ||
| 51 | + | ||
| 52 | + self._assertResizeCheckShape(x, x_shape, [320, 320], [320, 320, 3]) | ||
| 53 | + | ||
| 54 | ++ def testLargeDim(self): | ||
| 55 | ++ with self.session(): | ||
| 56 | ++ with self.assertRaises(errors.InternalError): | ||
| 57 | ++ x = np.ones((5, 1, 1, 2)) | ||
| 58 | ++ v = image_ops.resize_images_v2( | ||
| 59 | ++ x, [1610637938, 1610637938], image_ops.ResizeMethod.BILINEAR) | ||
| 60 | ++ _ = self.evaluate(v) | ||
| 61 | ++ | ||
| 62 | + | ||
| 63 | + class ResizeImagesTest(test_util.TensorFlowTestCase, | ||
| 64 | + parameterized.TestCase): | ||
| @@ -1,7 +1,7 @@ | |||
| 1 | %global _empty_manifest_terminate_build 0 | 1 | %global _empty_manifest_terminate_build 0 |
| 2 | Name: tensorflow | 2 | Name: tensorflow |
| 3 | Version: 2.12.1 | 3 | Version: 2.12.1 |
| 4 | -Release: 5 | 4 | +Release: 6 |
| 5 | Summary: An Open Source Machine Learning Framework for Everyone | 5 | Summary: An Open Source Machine Learning Framework for Everyone |
| 6 | License: Apache License 2.0 | 6 | License: Apache License 2.0 |
| 7 | URL: https://www.tensorflow.org/ | 7 | URL: https://www.tensorflow.org/ |
| @@ -17,6 +17,7 @@ Patch1000: aarch64_external_files.patch | |||
| 17 | %endif | 17 | %endif |
| 18 | %ifarch riscv64 | 18 | %ifarch riscv64 |
| 19 | Patch1100: riscv64_external_files.patch | 19 | Patch1100: riscv64_external_files.patch |
| 20 | +Patch1101: backport-CVE-2021-41199.patch | ||
| 20 | %endif | 21 | %endif |
| 21 | Requires: python3-future python3-numpy python3-six python3-astunparse python3-google-pasta python3-opt-einsum | 22 | Requires: python3-future python3-numpy python3-six python3-astunparse python3-google-pasta python3-opt-einsum |
| 22 | Requires: python3-typing-extensions python3-wrapt python3-h5py python3-protobuf python3-grpcio python3-absl-py | 23 | Requires: python3-typing-extensions python3-wrapt python3-h5py python3-protobuf python3-grpcio python3-absl-py |
| @@ -45,6 +46,7 @@ TensorFlow provides stable Python and C++ APIs, as well as non-guaranteed backwa | |||
| 45 | 46 | ||
| 46 | %prep | 47 | %prep |
| 47 | %setup -n %{name}-%{version} | 48 | %setup -n %{name}-%{version} |
| 49 | +%patch -P 1101 -p1 | ||
| 48 | %patch 0 -p1 | 50 | %patch 0 -p1 |
| 49 | %patch 1 -p1 | 51 | %patch 1 -p1 |
| 50 | %patch 2 -p1 | 52 | %patch 2 -p1 |
| @@ -84,6 +86,8 @@ bazel --output_user_root=`pwd`/../output_user_root build --nofetch --host_copt=- | |||
| 84 | %{_bindir}/* | 86 | %{_bindir}/* |
| 85 | 87 | ||
| 86 | %changelog | 88 | %changelog |
| 89 | +* Tue Jun 02 2026 sunwenhan <sunwenhan@xfusion.com> - 2.12.1-6 | ||
| 90 | +- Fix CVE-2021-41199 | ||
| 87 | * Tue Mar 03 2026 megranate wangkunjie@xfuison.com - 2.12.1-5 | 91 | * Tue Mar 03 2026 megranate wangkunjie@xfuison.com - 2.12.1-5 |
| 88 | - fix CVE-2026-2492 | 92 | - fix CVE-2026-2492 |
| 89 | 93 | ||
| @@ -122,4 +126,4 @@ bazel --output_user_root=`pwd`/../output_user_root build --nofetch --host_copt=- | |||
| 122 | - fix some cves | 126 | - fix some cves |
| 123 | 127 | ||
| 124 | * Wed Sep 30 2020 Zhipeng Xie<xiezhipeng1@huawei.com> - 2.3.1-1 | 128 | * Wed Sep 30 2020 Zhipeng Xie<xiezhipeng1@huawei.com> - 2.3.1-1 |
| 125 | -- Package init | 129 | +- Package init |