Vulnerability: Read and Write outside of bounds in TensorFlow ### Impact
An attacker can craft a TFLite model that would allow limited reads and writes outside of arrays in TFLite. This exploits missing validation in [the conversion from sparse tensors to dense tensors](https://github.com/tensorflow/tensorflow/blob/ca6f96b62ad84207fbec580404eaa7dd7403a550/tensorflow/lite/kernels/internal/utils/sparsity_format_converter.cc#L252-L293).

### Patches
We have patched the issue in GitHub commit [6364463d6f5b6254cac3d6aedf999b6a96225038](https://github.com/tensorflow/tensorflow/commit/6364463d6f5b6254cac3d6aedf999b6a96225038).
The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Wang Xuan of Qihoo 360 AIVul Team.
Vulnerability ID: GHSA-4hvf-hxvg-f67v
CWE: CWE-125
Severity score: 8.8
Project: https://github.com/tensorflow/tensorflow
Published: 2022-02-09
File: tensorflow/lite/kernels/internal/utils/sparsity_format_converter.cc
Commit message: [lite] Add some safety checks to avoid out of bound access for sparsity format

PiperOrigin-RevId: 416910386
Change-Id: Ic0b4dc048dc4b5a6309c572b8c4c9f776e4db60a
Commit author: Karim Nosir

Vulnerable version (before fix):
 void FormatConverter<T>::InitSparseToDenseConverter(   block_size_.resize(block_map_.size());   for (int i = 0; i < original_rank; i++) {     if (block_dim < block_map_.size() && block_map_[block_dim] == i) {       int orig_dim = traversal_order_[original_rank + block_dim];       block_size_[block_dim] = dense_size[orig_dim];       blocked_shape_[i] = dense_shape_[i] / dense_size[orig_dim];       block_dim++;     } else {       blocked_shape_[i] = dense_shape_[i];     } void FormatConverter<T>::Populate(const T* src_data, std::vector<int> indices,       Populate(src_data, indices, level + 1, prev_idx * shape_of_level + i,                src_data_ptr, dest_data);     }   } else {     const auto& array_segments = dim_metadata_[metadata_idx];     const auto& array_indices = dim_metadata_[metadata_idx + 1];     for (int i = array_segments[prev_idx]; i < array_segments[prev_idx + 1];          i++) {       indices[level] = array_indices[i];       Populate(src_data, indices, level + 1, i, src_data_ptr, dest_data);     }   } }

Fixed version (after fix):
 void FormatConverter<T>::InitSparseToDenseConverter(   block_size_.resize(block_map_.size());   for (int i = 0; i < original_rank; i++) {     if (block_dim < block_map_.size() && block_map_[block_dim] == i) {       if (original_rank + block_dim < traversal_order_.size()) {         int orig_dim = traversal_order_[original_rank + block_dim];         block_size_[block_dim] = dense_size[orig_dim];         blocked_shape_[i] = dense_shape_[i] / dense_size[orig_dim];         block_dim++;       }     } else {       blocked_shape_[i] = dense_shape_[i];     } void FormatConverter<T>::Populate(const T* src_data, std::vector<int> indices,       Populate(src_data, indices, level + 1, prev_idx * shape_of_level + i,                src_data_ptr, dest_data);     }   } else if (prev_idx + 1 < dim_metadata_[metadata_idx].size()) {     const auto& array_segments = dim_metadata_[metadata_idx];     const auto& array_indices = dim_metadata_[metadata_idx + 1];     for (int i = array_segments[prev_idx]; i < array_segments[prev_idx + 1];          i++) {       if (i < array_indices.size() && level < indices.size()) {         indices[level] = array_indices[i];         Populate(src_data, indices, level + 1, i, src_data_ptr, dest_data);       }     }   } }

Patch:
patch: @@ -282,10 +282,12 @@ void FormatConverter<T>::InitSparseToDenseConverter(
   block_size_.resize(block_map_.size());
   for (int i = 0; i < original_rank; i++) {
     if (block_dim < block_map_.size() && block_map_[block_dim] == i) {
-      int orig_dim = traversal_order_[original_rank + block_dim];
-      block_size_[block_dim] = dense_size[orig_dim];
-      blocked_shape_[i] = dense_shape_[i] / dense_size[orig_dim];
-      block_dim++;
+      if (original_rank + block_dim < traversal_order_.size()) {
+        int orig_dim = traversal_order_[original_rank + block_dim];
+        block_size_[block_dim] = dense_size[orig_dim];
+        blocked_shape_[i] = dense_shape_[i] / dense_size[orig_dim];
+        block_dim++;
+      }
     } else {
       blocked_shape_[i] = dense_shape_[i];
     }
@@ -328,13 +330,15 @@ void FormatConverter<T>::Populate(const T* src_data, std::vector<int> indices,
       Populate(src_data, indices, level + 1, prev_idx * shape_of_level + i,
                src_data_ptr, dest_data);
     }
-  } else {
+  } else if (prev_idx + 1 < dim_metadata_[metadata_idx].size()) {
     const auto& array_segments = dim_metadata_[metadata_idx];
     const auto& array_indices = dim_metadata_[metadata_idx + 1];
     for (int i = array_segments[prev_idx]; i < array_segments[prev_idx + 1];
          i++) {
-      indices[level] = array_indices[i];
-      Populate(src_data, indices, level + 1, i, src_data_ptr, dest_data);
+      if (i < array_indices.size() && level < indices.size()) {
+        indices[level] = array_indices[i];
+        Populate(src_data, indices, level + 1, i, src_data_ptr, dest_data);
+      }
     }
   }
 }
path: tensorflow/lite/kernels/internal/utils/sparsity_format_converter.cc