CVE-2022-23558: Integer Overflow or Wraparound (CWE-190)
value: Tensorflow is an Open Source Machine Learning Framework. An attacker can craft a TFLite model that would cause an integer overflow in `TfLiteIntArrayCreate`. The `TfLiteIntArrayGetSizeInBytes` returns an `int` instead of a `size_t. An attacker can control model inputs such that `computed_size` overflows the size of `int` datatype. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
CWE description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
CVSS v3 base score: 8.8
Published: 2022-02-04T23:15Z
Repository: https://github.com/tensorflow/tensorflow
Language: C
Files changed: tensorflow/lite/c/common.c, tensorflow/lite/c/common.h
Commit date: 2021-12-14 18:14:24 -0800
Commit message: [lite] Update TfLiteIntArrayCreate to return size_t

PiperOrigin-RevId: 416439896
Change-Id: I847f69b68d1ddaff4b1e925a09b8b69c1756653b

Diff: diff --git a/tensorflow/lite/c/common.c b/tensorflow/lite/c/common.c
index ef4d3ffdec555..d149d22c567c5 100644
--- a/tensorflow/lite/c/common.c
+++ b/tensorflow/lite/c/common.c
@@ -19,14 +19,14 @@ limitations under the License.
 #ifndef TF_LITE_STATIC_MEMORY
 #include <stdlib.h>
 #include <string.h>
 #endif  // TF_LITE_STATIC_MEMORY
 
-int TfLiteIntArrayGetSizeInBytes(int size) {
+size_t TfLiteIntArrayGetSizeInBytes(int size) {
   static TfLiteIntArray dummy;
 
-  int computed_size = sizeof(dummy) + sizeof(dummy.data[0]) * size;
+  size_t computed_size = sizeof(dummy) + sizeof(dummy.data[0]) * size;
 #if defined(_MSC_VER)
   // Context for why this is needed is in http://b/189926408#comment21
   computed_size -= sizeof(dummy.data[0]);
 #endif
   return computed_size;
@@ -49,11 +49,11 @@ int TfLiteIntArrayEqualsArray(const TfLiteIntArray* a, int b_size,
 }
 
 #ifndef TF_LITE_STATIC_MEMORY
 
 TfLiteIntArray* TfLiteIntArrayCreate(int size) {
-  int alloc_size = TfLiteIntArrayGetSizeInBytes(size);
+  size_t alloc_size = TfLiteIntArrayGetSizeInBytes(size);
   if (alloc_size <= 0) return NULL;
   TfLiteIntArray* ret = (TfLiteIntArray*)malloc(alloc_size);
   if (!ret) return ret;
   ret->size = size;
   return ret;
diff --git a/tensorflow/lite/c/common.h b/tensorflow/lite/c/common.h
index e02f6ef6d7c7e..7056d1e221132 100644
--- a/tensorflow/lite/c/common.h
+++ b/tensorflow/lite/c/common.h
@@ -96,11 +96,11 @@ typedef struct TfLiteIntArray {
 #endif
 } TfLiteIntArray;
 
 // Given the size (number of elements) in a TfLiteIntArray, calculate its size
 // in bytes.
-int TfLiteIntArrayGetSizeInBytes(int size);
+size_t TfLiteIntArrayGetSizeInBytes(int size);
 
 #ifndef TF_LITE_STATIC_MEMORY
 // Create a array of a given `size` (uninitialized entries).
 // This returns a pointer, that you must free using TfLiteIntArrayFree().
 TfLiteIntArray* TfLiteIntArrayCreate(int size);

Vulnerable code: int TfLiteIntArrayGetSizeInBytes(int size) {
  int computed_size = sizeof(dummy) + sizeof(dummy.data[0]) * size;
  int alloc_size = TfLiteIntArrayGetSizeInBytes(size);
int TfLiteIntArrayGetSizeInBytes(int size);
Fixed code: size_t TfLiteIntArrayGetSizeInBytes(int size) {
  size_t computed_size = sizeof(dummy) + sizeof(dummy.data[0]) * size;
  size_t alloc_size = TfLiteIntArrayGetSizeInBytes(size);
size_t TfLiteIntArrayGetSizeInBytes(int size);