CVE-2022-29213: Reachable Assertion (CWE-617)
value: TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the `tf.compat.v1.signal.rfft2d` and `tf.compat.v1.signal.rfft3d` lack input validation and under certain condition can result in crashes (due to `CHECK`-failures). Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.
CWE description: The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
CVSS v3 base score: 5.5
Published: 2022-05-21T00:15Z
Repository: https://github.com/tensorflow/tensorflow
Language: Python
Files changed: tensorflow/core/kernels/fft_ops.cc, tensorflow/python/kernel_tests/signal/fft_ops_test.py
Commit date: 2022-03-23 07:55:17 -0700
Commit message: Merge pull request #55274 from yongtang:55263-tf.signal.rfft2d

PiperOrigin-RevId: 436736690

Diff: diff --cc tensorflow/core/kernels/fft_ops.cc
index 14d0ebd983142,fccbcde50af7e..3186863884b1c
--- a/tensorflow/core/kernels/fft_ops.cc
+++ b/tensorflow/core/kernels/fft_ops.cc
@@@ -64,10 -64,16 +64,14 @@@ class FFTBase : public OpKernel 
                    errors::InvalidArgument("fft_length must have shape [",
                                            fft_rank, "]"));
  
        auto fft_length_as_vec = fft_length.vec<int32>();
        for (int i = 0; i < fft_rank; ++i) {
 -        OP_REQUIRES(
 -            ctx,
 -            fft_length_as_vec(i) >= 0,
 -            errors::InvalidArgument(
 -                "fft_length[" , i,
 -                "] must >= 0, but got: ", fft_length_as_vec(i)));
++        OP_REQUIRES(ctx, fft_length_as_vec(i) >= 0,
++                    errors::InvalidArgument(
++                        "fft_length[", i,
++                        "] must >= 0, but got: ", fft_length_as_vec(i)));
          fft_shape[i] = fft_length_as_vec(i);
          // Each input dimension must have length of at least fft_shape[i]. For
          // IRFFTs, the inner-most input dimension must have length of at least
          // fft_shape[i] / 2 + 1.
          bool inner_most = (i == fft_rank - 1);
diff --cc tensorflow/python/kernel_tests/signal/fft_ops_test.py
index a0e2b438a66ee,3e6d12a142409..67f8a47cef2d9
--- a/tensorflow/python/kernel_tests/signal/fft_ops_test.py
+++ b/tensorflow/python/kernel_tests/signal/fft_ops_test.py
@@@ -607,10 -607,20 +607,19 @@@ class RFFTOpsTest(BaseFFTOpsTest, param
        return
      self._check_grad_complex(
          self._tf_ifft_for_rank(rank), re, im, result_is_complex=False,
          rtol=tol, atol=tol)
  
+   def test_invalid_args(self):
+     # Test case for GitHub issue 55263
+     a = np.empty([6, 0])
+     b = np.array([1, -1])
 -    with self.assertRaisesRegex(
 -        errors.InvalidArgumentError, "must >= 0"):
++    with self.assertRaisesRegex(errors.InvalidArgumentError, "must >= 0"):
+       with self.session():
 -        v = fft_ops.rfft2d(input_tensor=a,fft_length=b)
++        v = fft_ops.rfft2d(input_tensor=a, fft_length=b)
+         self.evaluate(v)
+ 
  
  @test_util.run_all_in_graph_and_eager_modes
  class FFTShiftTest(test.TestCase, parameterized.TestCase):
  
    def test_definition(self):

Fixed code: +        OP_REQUIRES(ctx, fft_length_as_vec(i) >= 0,
+                    errors::InvalidArgument(
+                        "fft_length[", i,
+                        "] must >= 0, but got: ", fft_length_as_vec(i)));
   def test_invalid_args(self):
     # Test case for GitHub issue 55263
     a = np.empty([6, 0])
     b = np.array([1, -1])
+    with self.assertRaisesRegex(errors.InvalidArgumentError, "must >= 0"):
       with self.session():
+        v = fft_ops.rfft2d(input_tensor=a, fft_length=b)
         self.evaluate(v)