CVE-2021-41198: Integer Overflow or Wraparound (CWE-190)
value: TensorFlow is an open source platform for machine learning. In affected versions if `tf.tile` is called with a large input argument then the TensorFlow process will crash due to a `CHECK`-failure caused by an overflow. The number of elements in the output tensor is too much for the `int64_t` type and the overflow is detected via a `CHECK` statement. This aborts the process. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
CWE description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
CVSS v3 base score: 5.5
Published: 2021-11-05T20:15Z
Repository: https://github.com/tensorflow/tensorflow
Language: Python
Files changed: tensorflow/core/kernels/tile_ops.cc, tensorflow/python/kernel_tests/shape_ops_test.py
Commit date: 2021-09-20 18:50:30 -0700
Commit message: Merge pull request #51138 from yongtang:46911-tile

PiperOrigin-RevId: 397891537
Change-Id: I9b12304000e80dd87e6d4a42614ab10383a967b0

Diff: diff --cc tensorflow/core/kernels/tile_ops.cc
index 90cd36ad4dee2,e9b0428e610e8..f86bd4139b996
--- a/tensorflow/core/kernels/tile_ops.cc
+++ b/tensorflow/core/kernels/tile_ops.cc
@@@ -186,11 -186,13 +186,12 @@@ class TileOp : public OpKernel 
      for (int i = 0; i < input_dims; ++i) {
        OP_REQUIRES(
            context, multiples_array[i] >= 0,
            errors::InvalidArgument("Expected multiples[", i, "] >= 0, but got ",
                                    multiples_array[i]));
-       output_shape.AddDim(input.dim_size(i) * multiples_array[i]);
 -      OP_REQUIRES_OK(
 -          context,
 -          output_shape.AddDimWithStatus(input.dim_size(i) * multiples_array[i]));
++      OP_REQUIRES_OK(context, output_shape.AddDimWithStatus(
++                                  input.dim_size(i) * multiples_array[i]));
      }
      if (output_shape == input.shape()) {
        context->set_output(0, input);
        return;
      }
diff --cc tensorflow/python/kernel_tests/shape_ops_test.py
index c5f6d02da64ef,21dbd0dd59848..cfd216f1d3fbe
--- a/tensorflow/python/kernel_tests/shape_ops_test.py
+++ b/tensorflow/python/kernel_tests/shape_ops_test.py
@@@ -721,8 -721,16 +721,19 @@@ class TileTest(test.TestCase, parameter
      with self.assertRaises(ValueError):
        tiled = array_ops.tile(
            inp, array_ops.placeholder(
                dtypes.int32, shape=[3]))
  
+   def testLargeTensor(self):
+     # Test case for GItHub issue 46911.
++    if test_util.is_xla_enabled():
++      # The following test fails with XLA enabled.
++      return
+     with self.assertRaises(errors_impl.InternalError):
+       with self.cached_session():
+         tiled = array_ops.tile(
+             np.ones((1, 1, 1)), [100000000, 100000000, 100000000])
 -        result = self.evaluate(tiled)
++        self.evaluate(tiled)
+ 
  
  if __name__ == "__main__":
    test.main()

Vulnerable code:        output_shape.AddDim(input.dim_size(i) * multiples_array[i]);
Fixed code: +      OP_REQUIRES_OK(context, output_shape.AddDimWithStatus(
+                                  input.dim_size(i) * multiples_array[i]));
   def testLargeTensor(self):
     # Test case for GItHub issue 46911.
+    if test_util.is_xla_enabled():
+      # The following test fails with XLA enabled.
+      return
     with self.assertRaises(errors_impl.InternalError):
       with self.cached_session():
         tiled = array_ops.tile(
             np.ones((1, 1, 1)), [100000000, 100000000, 100000000])
+        self.evaluate(tiled)