Vulnerability: Null-dereference in Tensorflow ### Impact
The [implementation of `GetInitOp`](https://github.com/tensorflow/tensorflow/blob/a1320ec1eac186da1d03f033109191f715b2b130/tensorflow/cc/saved_model/loader_util.cc#L31-L61) is vulnerable to a crash caused by dereferencing a null pointer:

```cc
const auto& init_op_sig_it =
    meta_graph_def.signature_def().find(kSavedModelInitOpSignatureKey);
if (init_op_sig_it != sig_def_map.end()) {
  *init_op_name = init_op_sig_it->second.outputs()
                      .find(kSavedModelInitOpSignatureKey)
                      ->second.name();
  return Status::OK();
}
```

Here, we have a nested map and we assume that if the first `.find` succeeds then so would be the search in the internal map. However, the maps are built based on the `SavedModel` protobuf format and a malicious user can alter that on disk before loading to cause the second `.find` to return `nullptr`.
### Patches
We have patched the issue in GitHub commit [4f38b1ac8e42727e18a2f0bde06d3bee8e77b250](https://github.com/tensorflow/tensorflow/commit/4f38b1ac8e42727e18a2f0bde06d3bee8e77b250).

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
Vulnerability ID: GHSA-8cxv-76p7-jxwr
CWE: CWE-476
Severity score: 6.5
Project: https://github.com/tensorflow/tensorflow
Published: 2022-02-10
File: tensorflow/cc/saved_model/loader_util.cc
Commit message: Prevent null dereference read in `GetInitOp`.

We have a map of maps. We test that the key exists in the first map but then we don't have any validation that this also means the second map has the needed key. In the scenarios where this is not the case, we'll dereference a nullptr, if we don't have this check

PiperOrigin-RevId: 408739325
Change-Id: If9bb7ed759aba1f3b56a34913f209508dbaf65ce
Commit author: Mihai Maruseac

Vulnerable version (before fix):
 Status GetInitOp(const string& export_dir, const MetaGraphDef& meta_graph_def,   const auto& init_op_sig_it =       meta_graph_def.signature_def().find(kSavedModelInitOpSignatureKey);   if (init_op_sig_it != sig_def_map.end()) {     *init_op_name = init_op_sig_it->second.outputs()                         .find(kSavedModelInitOpSignatureKey)                         ->second.name();     return Status::OK();   } 

Fixed version (after fix):
 Status GetInitOp(const string& export_dir, const MetaGraphDef& meta_graph_def,   const auto& init_op_sig_it =       meta_graph_def.signature_def().find(kSavedModelInitOpSignatureKey);   if (init_op_sig_it != sig_def_map.end()) {     const auto& sig_def_outputs = init_op_sig_it->second.outputs();     const auto& sig_def_outputs_it =         sig_def_outputs.find(kSavedModelInitOpSignatureKey);     if (sig_def_outputs_it == sig_def_outputs.end()) {       return errors::FailedPrecondition("Could not find output ",                                         kSavedModelInitOpSignatureKey);     }     *init_op_name = sig_def_outputs_it->second.name();     return Status::OK();   } 

Patch:
patch: @@ -34,9 +34,14 @@ Status GetInitOp(const string& export_dir, const MetaGraphDef& meta_graph_def,
   const auto& init_op_sig_it =
       meta_graph_def.signature_def().find(kSavedModelInitOpSignatureKey);
   if (init_op_sig_it != sig_def_map.end()) {
-    *init_op_name = init_op_sig_it->second.outputs()
-                        .find(kSavedModelInitOpSignatureKey)
-                        ->second.name();
+    const auto& sig_def_outputs = init_op_sig_it->second.outputs();
+    const auto& sig_def_outputs_it =
+        sig_def_outputs.find(kSavedModelInitOpSignatureKey);
+    if (sig_def_outputs_it == sig_def_outputs.end()) {
+      return errors::FailedPrecondition("Could not find output ",
+                                        kSavedModelInitOpSignatureKey);
+    }
+    *init_op_name = sig_def_outputs_it->second.name();
     return Status::OK();
   }
path: tensorflow/cc/saved_model/loader_util.cc