Vulnerability: `SparseFillEmptyRows` heap OOB ### Impact
The [implementation](https://github.com/tensorflow/tensorflow/blob/e71b86d47f8bc1816bf54d7bddc4170e47670b97/tensorflow/core/kernels/sparse_fill_empty_rows_op.cc#L194-L241) of `SparseFillEmptyRows` can be made to trigger a heap OOB access:

```python
import tensorflow as tf
  
data=tf.raw_ops.SparseFillEmptyRows(
  indices=[[0,0],[0,0],[0,0]],
  values=['sssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssss'],
  dense_shape=[5,3],
  default_value='o')
```
  
This occurs whenever the size of `indices` does not match the size of `values`.

### Patches
We have patched the issue in GitHub commit [67bfd9feeecfb3c61d80f0e46d89c170fbee682b](https://github.com/tensorflow/tensorflow/commit/67bfd9feeecfb3c61d80f0e46d89c170fbee682b).

The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability ID: GHSA-rg3m-hqc5-344v
CWE: CWE-125
Severity score: 7.1
Project: https://github.com/tensorflow/tensorflow
Published: 2021-11-10
File: tensorflow/core/kernels/sparse_fill_empty_rows_op.cc
Commit message: Make SparseFillEmptyRows validate that the length of `values` must be equal to the number of index tuples.

PiperOrigin-RevId: 399969549
Change-Id: I3c2f2ca1c1d2cc88bb5951c6958b38c16e9436c8
Commit author: Penporn Koanantakool

Vulnerable version (before fix):
 limitations under the License. #include <vector>  #include "tensorflow/core/framework/op_kernel.h" #include "tensorflow/core/framework/register_types.h" #include "tensorflow/core/framework/tensor.h" #include "tensorflow/core/framework/tensor_util.h" #include "tensorflow/core/framework/types.h" #include "tensorflow/core/lib/gtl/inlined_vector.h" #include "tensorflow/core/util/sparse/sparse_tensor.h"  namespace tensorflow { void SparseFillEmptyRowsOpImpl(OpKernelContext* context,                     errors::InvalidArgument("values must be a vector, saw: ",                                             values_t.shape().DebugString()),                     done);   OP_REQUIRES_ASYNC(       context, TensorShapeUtils::IsScalar(default_value_t.shape()),       errors::InvalidArgument("default_value must be a scalar, saw: ",

Fixed version (after fix):
 limitations under the License. #include <vector>  #include "tensorflow/core/framework/op_kernel.h" #include "tensorflow/core/framework/op_requires.h" #include "tensorflow/core/framework/register_types.h" #include "tensorflow/core/framework/tensor.h" #include "tensorflow/core/framework/tensor_util.h" #include "tensorflow/core/framework/types.h" #include "tensorflow/core/lib/gtl/inlined_vector.h" #include "tensorflow/core/platform/errors.h" #include "tensorflow/core/util/sparse/sparse_tensor.h"  namespace tensorflow { void SparseFillEmptyRowsOpImpl(OpKernelContext* context,                     errors::InvalidArgument("values must be a vector, saw: ",                                             values_t.shape().DebugString()),                     done);   OP_REQUIRES_ASYNC(       context, indices_t.dim_size(0) == values_t.dim_size(0),       errors::InvalidArgument("The length of `values` (", values_t.dim_size(0),                               ") must match the first dimension of `indices` (",                               indices_t.dim_size(0), ")."),       done);   OP_REQUIRES_ASYNC(       context, TensorShapeUtils::IsScalar(default_value_t.shape()),       errors::InvalidArgument("default_value must be a scalar, saw: ",

Patch:
patch: @@ -24,11 +24,13 @@ limitations under the License.
 #include <vector>
 
 #include "tensorflow/core/framework/op_kernel.h"
+#include "tensorflow/core/framework/op_requires.h"
 #include "tensorflow/core/framework/register_types.h"
 #include "tensorflow/core/framework/tensor.h"
 #include "tensorflow/core/framework/tensor_util.h"
 #include "tensorflow/core/framework/types.h"
 #include "tensorflow/core/lib/gtl/inlined_vector.h"
+#include "tensorflow/core/platform/errors.h"
 #include "tensorflow/core/util/sparse/sparse_tensor.h"
 
 namespace tensorflow {
@@ -222,6 +224,12 @@ void SparseFillEmptyRowsOpImpl(OpKernelContext* context,
                     errors::InvalidArgument("values must be a vector, saw: ",
                                             values_t.shape().DebugString()),
                     done);
+  OP_REQUIRES_ASYNC(
+      context, indices_t.dim_size(0) == values_t.dim_size(0),
+      errors::InvalidArgument("The length of `values` (", values_t.dim_size(0),
+                              ") must match the first dimension of `indices` (",
+                              indices_t.dim_size(0), ")."),
+      done);
   OP_REQUIRES_ASYNC(
       context, TensorShapeUtils::IsScalar(default_value_t.shape()),
       errors::InvalidArgument("default_value must be a scalar, saw: ",
path: tensorflow/core/kernels/sparse_fill_empty_rows_op.cc