Star0
8
代码
代码
Issues213
Pull Requests33
项目讨论
Wiki
分析
Star0
8
已开启
Fix CVE-2022-29203 #132
XingSongSun创建于 6月2日
Fix CVE-2022-29203 #132
已开启
XingSongSun创建于 6月2日
从XingSongSun/tensorflowCVE-2022-29203合入到src-openeuler/tensorflowopenEuler-24.03-LTS-SP3
共 2 个文件变更+315-2
Abackport-CVE-2022-29203.patch+309-0
@@ -0,0 +1,309 @@
1+From acd56b8bcb72b163c834ae4f18469047b001fadf Mon Sep 17 00:00:00 2001
2+From: Sagun Bajra <sagunb@google.com>
3+Date: Fri, 29 Apr 2022 16:08:37 -0700
4+Subject: [PATCH] Fix security vulnerability with SpaceToBatchNDOp.
5+ 
6+PiperOrigin-RevId: 445527615
7+---
8+ .../compiler/tests/spacetobatch_op_test.py | 24 +++++++++++++++++++
9+ tensorflow/compiler/tf2xla/kernels/BUILD | 1 +
10+ .../tf2xla/kernels/spacetobatch_op.cc | 20 +++++++++++++---
11+ tensorflow/core/framework/BUILD | 1 +
12+ tensorflow/core/framework/shape_inference.cc | 3 ++-
13+ tensorflow/core/kernels/BUILD | 6 ++---
14+ tensorflow/core/kernels/spacetobatch_op.cc | 22 +++++++++++++----
15+ tensorflow/core/util/BUILD | 3 +++
16+ .../array_ops/spacetobatch_op_test.py | 23 ++++++++++++++++++
17+ 9 files changed, 90 insertions(+), 13 deletions(-)
18+ 
19+diff --git a/tensorflow/compiler/tests/spacetobatch_op_test.py b/tensorflow/compiler/tests/spacetobatch_op_test.py
20+index bb3d4b1812080c..016c05f11e0c2a 100644
21+--- a/tensorflow/compiler/tests/spacetobatch_op_test.py
22++++ b/tensorflow/compiler/tests/spacetobatch_op_test.py
23+@@ -17,6 +17,7 @@
24+ import numpy as np
25+
26+ from tensorflow.compiler.tests import xla_test
27++from tensorflow.python.framework import constant_op
28+ from tensorflow.python.framework import dtypes
29+ from tensorflow.python.ops import array_ops
30+ from tensorflow.python.ops import gen_array_ops
31+@@ -145,6 +146,29 @@ def testLargerInputBatch2x2(self):
32+ self._testOne(x_np, block_size, x_out)
33+
34+
35++class SpaceToBatchNDErrorHandlingTest(xla_test.XLATestCase):
36++
37++ def testInvalidBlockShape(self):
38++ with self.assertRaisesRegex(ValueError, "block_shape must be positive"):
39++ with self.session() as sess, self.test_scope():
40++ tf_in = constant_op.constant(
41++ -3.5e+35, shape=[10, 20, 20], dtype=dtypes.float32)
42++ block_shape = constant_op.constant(-10, shape=[2], dtype=dtypes.int64)
43++ paddings = constant_op.constant(0, shape=[2, 2], dtype=dtypes.int32)
44++ sess.run(array_ops.space_to_batch_nd(tf_in, block_shape, paddings))
45++
46++ def testOutputSizeOutOfBounds(self):
47++ with self.assertRaisesRegex(ValueError,
48++ "Negative.* dimension size caused by overflow"):
49++ with self.session() as sess, self.test_scope():
50++ tf_in = constant_op.constant(
51++ -3.5e+35, shape=[10, 19, 22], dtype=dtypes.float32)
52++ block_shape = constant_op.constant(
53++ 1879048192, shape=[2], dtype=dtypes.int64)
54++ paddings = constant_op.constant(0, shape=[2, 2], dtype=dtypes.int32)
55++ sess.run(array_ops.space_to_batch_nd(tf_in, block_shape, paddings))
56++
57++
58+ class SpaceToBatchNDTest(xla_test.XLATestCase):
59+ """Tests input-output pairs for the SpaceToBatchND and BatchToSpaceND ops."""
60+
61+diff --git a/tensorflow/compiler/tf2xla/kernels/BUILD b/tensorflow/compiler/tf2xla/kernels/BUILD
62+index ca28459476e8d9..873b892423f9f1 100644
63+--- a/tensorflow/compiler/tf2xla/kernels/BUILD
64++++ b/tensorflow/compiler/tf2xla/kernels/BUILD
65+@@ -211,6 +211,7 @@ tf_kernel_library(
66+ "//tensorflow/core/kernels:stateful_random_ops_header",
67+ "//tensorflow/core/kernels:stateless_random_ops_v2_header",
68+ "//tensorflow/core/tpu:tpu_defs",
69++ "//tensorflow/core/util:overflow",
70+ "//tensorflow/stream_executor/lib",
71+ "@com_google_absl//absl/algorithm:container",
72+ "@com_google_absl//absl/container:flat_hash_map",
73+diff --git a/tensorflow/compiler/tf2xla/kernels/spacetobatch_op.cc b/tensorflow/compiler/tf2xla/kernels/spacetobatch_op.cc
74+index a4e9aec1c97058..d6e38f1309f91c 100644
75+--- a/tensorflow/compiler/tf2xla/kernels/spacetobatch_op.cc
76++++ b/tensorflow/compiler/tf2xla/kernels/spacetobatch_op.cc
77+@@ -17,6 +17,7 @@ limitations under the License.
78+ #include "tensorflow/compiler/tf2xla/xla_op_kernel.h"
79+ #include "tensorflow/compiler/tf2xla/xla_op_registry.h"
80+ #include "tensorflow/compiler/xla/client/xla_builder.h"
81++#include "tensorflow/core/util/overflow.h"
82+
83+ namespace tensorflow {
84+ namespace {
85+@@ -60,10 +61,14 @@ void SpaceToBatch(XlaOpKernelContext* ctx, const xla::XlaOp& input,
86+ int64_t pad_end = paddings.Get<int64_t>({i, 1});
87+ OP_REQUIRES(ctx, pad_start >= 0 && pad_end >= 0,
88+ errors::InvalidArgument("Paddings must be non-negative"));
89++ OP_REQUIRES(ctx, block_shape[i] >= 1,
90++ errors::InvalidArgument(
91++ "All values in block_shape must be positive, got value, ",
92++ block_shape[i], " at index ", i, "."));
93+ dim->set_edge_padding_low(pad_start);
94+ dim->set_edge_padding_high(pad_end);
95+ padded_shape[1 + i] += pad_start + pad_end;
96+- block_num_elems *= block_shape[i];
97++ block_num_elems = MultiplyWithoutOverflow(block_num_elems, block_shape[i]);
98+ }
99+ // Don't pad the remainder dimensions.
100+ for (int i = 0; i < remainder_shape.size(); ++i) {
101+@@ -72,6 +77,16 @@ void SpaceToBatch(XlaOpKernelContext* ctx, const xla::XlaOp& input,
102+ OP_REQUIRES(ctx, block_num_elems > 0,
103+ errors::InvalidArgument(
104+ "The product of the block dimensions must be positive"));
105++ const int64_t batch_size = input_shape[0];
106++ const int64_t output_dim =
107++ MultiplyWithoutOverflow(batch_size, block_num_elems);
108++ if (output_dim < 0) {
109++ OP_REQUIRES(
110++ ctx, output_dim >= 0,
111++ errors::InvalidArgument("Negative output dimension size caused by "
112++ "overflow when multiplying ",
113++ batch_size, " and ", block_num_elems));
114++ }
115+
116+ xla::XlaOp padded =
117+ xla::Pad(input, XlaHelpers::Zero(b, input_dtype), padding_config);
118+@@ -85,7 +100,6 @@ void SpaceToBatch(XlaOpKernelContext* ctx, const xla::XlaOp& input,
119+ // padded_shape[M] / block_shape[M-1],
120+ // block_shape[M-1]] +
121+ // remaining_shape
122+- const int64_t batch_size = input_shape[0];
123+ std::vector<int64_t> reshaped_padded_shape(input_rank + block_rank);
124+ reshaped_padded_shape[0] = batch_size;
125+ for (int i = 0; i < block_rank; ++i) {
126+@@ -134,7 +148,7 @@ void SpaceToBatch(XlaOpKernelContext* ctx, const xla::XlaOp& input,
127+ // Determine the length of the prefix of block dims that can be combined
128+ // into the batch dimension due to having no padding and block_shape=1.
129+ std::vector<int64_t> output_shape(input_rank);
130+- output_shape[0] = batch_size * block_num_elems;
131++ output_shape[0] = output_dim;
132+ for (int i = 0; i < block_rank; ++i) {
133+ output_shape[1 + i] = padded_shape[1 + i] / block_shape[i];
134+ }
135+diff --git a/tensorflow/core/framework/BUILD b/tensorflow/core/framework/BUILD
136+index 4f927b10aa4848..e3dc844c0343dd 100644
137+--- a/tensorflow/core/framework/BUILD
138++++ b/tensorflow/core/framework/BUILD
139+@@ -891,6 +891,7 @@ cc_library(
140+ "//tensorflow/core/lib/strings:scanner",
141+ "//tensorflow/core/lib/strings:str_util",
142+ "//tensorflow/core/platform:macros",
143++ "//tensorflow/core/util:overflow",
144+ "@com_google_absl//absl/memory",
145+ ],
146+ )
147+diff --git a/tensorflow/core/framework/shape_inference.cc b/tensorflow/core/framework/shape_inference.cc
148+index 9f854788b1aed8..2dedd683d7c100 100644
149+--- a/tensorflow/core/framework/shape_inference.cc
150++++ b/tensorflow/core/framework/shape_inference.cc
151+@@ -26,6 +26,7 @@ limitations under the License.
152+ #include "tensorflow/core/lib/strings/numbers.h"
153+ #include "tensorflow/core/lib/strings/scanner.h"
154+ #include "tensorflow/core/lib/strings/str_util.h"
155++#include "tensorflow/core/util/overflow.h"
156+
157+ namespace tensorflow {
158+ namespace shape_inference {
159+@@ -1111,7 +1112,7 @@ Status InferenceContext::Multiply(DimensionHandle first,
160+ *out = UnknownDim();
161+ } else {
162+ // Invariant: Both values are known and greater than 1.
163+- const int64_t product = first_value * second_value;
164++ const int64_t product = MultiplyWithoutOverflow(first_value, second_value);
165+ if (product < 0) {
166+ return errors::InvalidArgument(
167+ "Negative dimension size caused by overflow when multiplying ",
168+diff --git a/tensorflow/core/kernels/BUILD b/tensorflow/core/kernels/BUILD
169+index 94943cc04adfab..8c7ee12b4a8dd0 100644
170+--- a/tensorflow/core/kernels/BUILD
171++++ b/tensorflow/core/kernels/BUILD
172+@@ -29,6 +29,7 @@ load(
173+ load(
174+ "//third_party/mkl:build_defs.bzl",
175+ "if_mkl",
176++ "mkl_deps",
177+ )
178+
179+ # buildifier: disable=same-origin-load
180+@@ -61,10 +62,6 @@ load(
181+ "//tensorflow/core/platform:build_config_root.bzl",
182+ "tf_cuda_tests_tags",
183+ )
184+-load(
185+- "//third_party/mkl:build_defs.bzl",
186+- "mkl_deps",
187+-)
188+ load("@local_config_cuda//cuda:build_defs.bzl", "if_cuda")
189+ load(
190+ "@local_config_rocm//rocm:build_defs.bzl",
191+@@ -4569,6 +4566,7 @@ tf_kernel_library(
192+ "//tensorflow/core:framework",
193+ "//tensorflow/core:lib",
194+ "//tensorflow/core/framework:bounds_check",
195++ "//tensorflow/core/util:overflow",
196+ "//third_party/eigen3",
197+ ],
198+ )
199+diff --git a/tensorflow/core/kernels/spacetobatch_op.cc b/tensorflow/core/kernels/spacetobatch_op.cc
200+index 009500f79268fc..e391529d852b04 100644
201+--- a/tensorflow/core/kernels/spacetobatch_op.cc
202++++ b/tensorflow/core/kernels/spacetobatch_op.cc
203+@@ -21,8 +21,6 @@ limitations under the License.
204+ #include <string>
205+ #include <utility>
206+
207+-#include "tensorflow/core/kernels/spacetobatch_functor.h"
208+-
209+ #include "third_party/eigen3/unsupported/Eigen/CXX11/Tensor"
210+ #include "tensorflow/core/framework/op.h"
211+ #include "tensorflow/core/framework/op_kernel.h"
212+@@ -31,8 +29,10 @@ limitations under the License.
213+ #include "tensorflow/core/framework/tensor_shape.h"
214+ #include "tensorflow/core/framework/tensor_types.h"
215+ #include "tensorflow/core/framework/types.h"
216++#include "tensorflow/core/kernels/spacetobatch_functor.h"
217+ #include "tensorflow/core/platform/logging.h"
218+ #include "tensorflow/core/platform/types.h"
219++#include "tensorflow/core/util/overflow.h"
220+
221+ namespace tensorflow {
222+
223+@@ -99,7 +99,13 @@ Status SpaceToBatchOpCompute(OpKernelContext* context,
224+ // Compute the product of the block_shape values.
225+ int64_t block_shape_product = 1;
226+ for (int block_dim = 0; block_dim < block_dims; ++block_dim) {
227+- block_shape_product *= block_shape[block_dim];
228++ if (block_shape[block_dim] < 1) {
229++ return errors::InvalidArgument(
230++ "All values in block_shape must be positive, got value, ",
231++ block_shape[block_dim], " at index ", block_dim, ".");
232++ }
233++ block_shape_product =
234++ MultiplyWithoutOverflow(block_shape_product, block_shape[block_dim]);
235+ }
236+ if (block_shape_product <= 0) {
237+ return errors::InvalidArgument(
238+@@ -131,8 +137,14 @@ Status SpaceToBatchOpCompute(OpKernelContext* context,
239+ // The actual output shape exposed to callers.
240+ TensorShape external_output_shape;
241+
242+- external_output_shape.AddDim(orig_input_tensor.dim_size(0) *
243+- block_shape_product);
244++ const int64_t output_shape = MultiplyWithoutOverflow(
245++ orig_input_tensor.dim_size(0), block_shape_product);
246++ if (output_shape < 0) {
247++ return errors::InvalidArgument(
248++ "Negative output dimension size caused by overflow when multiplying ",
249++ orig_input_tensor.dim_size(0), " and ", block_shape_product);
250++ }
251++ external_output_shape.AddDim(output_shape);
252+
253+ int64_t input_batch_size = orig_input_tensor.dim_size(0);
254+ for (int block_dim = 0; block_dim < removed_prefix_block_dims; ++block_dim) {
255+diff --git a/tensorflow/core/util/BUILD b/tensorflow/core/util/BUILD
256+index 8c267148fb74f2..8881f6fd5e9147 100644
257+--- a/tensorflow/core/util/BUILD
258++++ b/tensorflow/core/util/BUILD
259+@@ -533,6 +533,9 @@ tf_cuda_library(
260+ cc_library(
261+ name = "overflow",
262+ hdrs = ["overflow.h"],
263++ visibility = [
264++ "//tensorflow:internal",
265++ ],
266+ deps = [
267+ "//tensorflow/core/platform:logging",
268+ "//tensorflow/core/platform:macros",
269+diff --git a/tensorflow/python/kernel_tests/array_ops/spacetobatch_op_test.py b/tensorflow/python/kernel_tests/array_ops/spacetobatch_op_test.py
270+index a095aced262ecd..5e682364837e55 100644
271+--- a/tensorflow/python/kernel_tests/array_ops/spacetobatch_op_test.py
272++++ b/tensorflow/python/kernel_tests/array_ops/spacetobatch_op_test.py
273+@@ -16,7 +16,9 @@
274+
275+ import numpy as np
276+
277++from tensorflow.python.framework import constant_op
278+ from tensorflow.python.framework import dtypes
279++from tensorflow.python.framework import errors
280+ from tensorflow.python.framework import ops
281+ from tensorflow.python.framework import tensor_util
282+ from tensorflow.python.framework import test_util
283+@@ -516,6 +518,27 @@ def testUnknown(self):
284+ dtypes.float32, shape=(3, 2, 3, 2)), [2, 3], [[1, 1], [0, 0]])
285+ self.assertEqual([3 * 2 * 3, 2, 1, 2], t.get_shape().as_list())
286+
287++ @test_util.run_in_graph_and_eager_modes
288++ def testInvalidBlockShape(self):
289++ tf_in = constant_op.constant(
290++ -3.5e+35, shape=[10, 20, 20], dtype=dtypes.float32)
291++ block_shape = constant_op.constant(-10, shape=[2], dtype=dtypes.int64)
292++ paddings = constant_op.constant(0, shape=[2, 2], dtype=dtypes.int32)
293++ with self.assertRaisesRegex((ValueError, errors.InvalidArgumentError),
294++ "block_shape must be positive"):
295++ array_ops.space_to_batch_nd(tf_in, block_shape, paddings)
296++
297++ @test_util.run_in_graph_and_eager_modes
298++ def testOutputSizeOutOfBounds(self):
299++ tf_in = constant_op.constant(
300++ -3.5e+35, shape=[10, 19, 22], dtype=dtypes.float32)
301++ block_shape = constant_op.constant(
302++ 1879048192, shape=[2], dtype=dtypes.int64)
303++ paddings = constant_op.constant(0, shape=[2, 2], dtype=dtypes.int32)
304++ with self.assertRaisesRegex((ValueError, errors.InvalidArgumentError),
305++ "Negative.* dimension size caused by overflow"):
306++ array_ops.space_to_batch_nd(tf_in, block_shape, paddings)
307++
308+
309+ class SpaceToBatchGradientTest(test.TestCase, PythonOpImpl):
Mtensorflow.spec+6-2
@@ -1,7 +1,7 @@
1%global _empty_manifest_terminate_build 01%global _empty_manifest_terminate_build 0
2Name: tensorflow2Name: tensorflow
3Version: 2.12.13Version: 2.12.1
4-Release: 54+Release: 6
5Summary: An Open Source Machine Learning Framework for Everyone5Summary: An Open Source Machine Learning Framework for Everyone
6License: Apache License 2.06License: Apache License 2.0
7URL: https://www.tensorflow.org/7URL: https://www.tensorflow.org/
@@ -17,6 +17,7 @@ Patch1000: aarch64_external_files.patch
17%endif17%endif
18%ifarch riscv6418%ifarch riscv64
19Patch1100: riscv64_external_files.patch19Patch1100: riscv64_external_files.patch
20+Patch1101: backport-CVE-2022-29203.patch
20%endif21%endif
21Requires: python3-future python3-numpy python3-six python3-astunparse python3-google-pasta python3-opt-einsum22Requires: python3-future python3-numpy python3-six python3-astunparse python3-google-pasta python3-opt-einsum
22Requires: python3-typing-extensions python3-wrapt python3-h5py python3-protobuf python3-grpcio python3-absl-py 23Requires: python3-typing-extensions python3-wrapt python3-h5py python3-protobuf python3-grpcio python3-absl-py
@@ -45,6 +46,7 @@ TensorFlow provides stable Python and C++ APIs, as well as non-guaranteed backwa
45 46 
46%prep47%prep
47%setup -n %{name}-%{version}48%setup -n %{name}-%{version}
49+%patch -P 1101 -p1
48%patch 0 -p150%patch 0 -p1
49%patch 1 -p151%patch 1 -p1
50%patch 2 -p152%patch 2 -p1
@@ -84,6 +86,8 @@ bazel --output_user_root=`pwd`/../output_user_root build --nofetch --host_copt=-
84%{_bindir}/*86%{_bindir}/*
85 87 
86%changelog88%changelog
89+* Tue Jun 02 2026 sunwenhan <sunwenhan@xfusion.com> - 2.12.1-6
90+- Fix CVE-2022-29203
87* Tue Mar 03 2026 megranate wangkunjie@xfuison.com - 2.12.1-591* Tue Mar 03 2026 megranate wangkunjie@xfuison.com - 2.12.1-5
88- fix CVE-2026-249292- fix CVE-2026-2492
89 93 
@@ -122,4 +126,4 @@ bazel --output_user_root=`pwd`/../output_user_root build --nofetch --host_copt=-
122- fix some cves126- fix some cves
123 127 
124* Wed Sep 30 2020 Zhipeng Xie<xiezhipeng1@huawei.com> - 2.3.1-1128* Wed Sep 30 2020 Zhipeng Xie<xiezhipeng1@huawei.com> - 2.3.1-1
125-- Package init129+- Package init