Vulnerability: Heap OOB in TFLite ### Impact
TFLite's [`expand_dims.cc`](https://github.com/tensorflow/tensorflow/blob/149562d49faa709ea80df1d99fc41d005b81082a/tensorflow/lite/kernels/expand_dims.cc#L36-L50) contains a vulnerability which allows reading one element outside of bounds of heap allocated data:

```cc
  if (axis < 0) { 
    axis = input_dims.size + 1 + axis;
  }   
  TF_LITE_ENSURE(context, axis <= input_dims.size);

  TfLiteIntArray* output_dims = TfLiteIntArrayCreate(input_dims.size + 1);
  for (int i = 0; i < output_dims->size; ++i) {
    if (i < axis) {
      output_dims->data[i] = input_dims.data[i];
    } else if (i == axis) {
      output_dims->data[i] = 1;
    } else {
      output_dims->data[i] = input_dims.data[i - 1];
    }
  }
```

If `axis` is a large negative value (e.g., `-100000`), then after the first `if` it would still be negative. The check following the `if` statement will pass and the `for` loop would read one element before the start of `input_dims.data` (when `i = 0`).

### Patches
We have patched the issue in GitHub commit [d94ffe08a65400f898241c0374e9edc6fa8ed257](https://github.com/tensorflow/tensorflow/commit/d94ffe08a65400f898241c0374e9edc6fa8ed257).

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Yakun Zhang of Baidu Security.
Vulnerability ID: GHSA-c545-c4f9-rf6v
CWE: CWE-125
Severity score: 5.5
Project: https://github.com/tensorflow/tensorflow
Published: 2021-08-25
File: tensorflow/lite/kernels/expand_dims.cc
Commit message: Prevent an OOB read in `expand_dims.cc`

The for loop that follows this check assumes that `axis` is between `0` and `input_dims.size`. If user supplied `axis` is negative, the if code before this check is supposed to bring it back to positive (similar to how in Python one can do `l[-3]` to mean `l[-3 + len(l)]`).

PiperOrigin-RevId: 387200206
Change-Id: I162f4feba12d547c3a4340833ae682016a2ebfab
Commit author: Mihai Maruseac

Vulnerable version (before fix):
 TfLiteStatus ExpandTensorDim(TfLiteContext* context, const TfLiteTensor& input,     axis = input_dims.size + 1 + axis;   }   TF_LITE_ENSURE(context, axis <= input_dims.size);    TfLiteIntArray* output_dims = TfLiteIntArrayCreate(input_dims.size + 1);   for (int i = 0; i < output_dims->size; ++i) {

Fixed version (after fix):
 TfLiteStatus ExpandTensorDim(TfLiteContext* context, const TfLiteTensor& input,     axis = input_dims.size + 1 + axis;   }   TF_LITE_ENSURE(context, axis <= input_dims.size);   TF_LITE_ENSURE(context, axis >= 0);    TfLiteIntArray* output_dims = TfLiteIntArrayCreate(input_dims.size + 1);   for (int i = 0; i < output_dims->size; ++i) {

Patch:
patch: @@ -37,6 +37,7 @@ TfLiteStatus ExpandTensorDim(TfLiteContext* context, const TfLiteTensor& input,
     axis = input_dims.size + 1 + axis;
   }
   TF_LITE_ENSURE(context, axis <= input_dims.size);
+  TF_LITE_ENSURE(context, axis >= 0);
 
   TfLiteIntArray* output_dims = TfLiteIntArrayCreate(input_dims.size + 1);
   for (int i = 0; i < output_dims->size; ++i) {
path: tensorflow/lite/kernels/expand_dims.cc