Fix use after free in xnn_insert_clamp_node

xnn_define_tensor_value can invalidate the output_value pointer, so copy data referred from it before calling xnn_define_tensor_value. PiperOrigin-RevId: 678807574
imaginationtech · Sep 25, 2024 · 2286715 · 2286715
1 parent 3ac5962
commit 2286715
Showing 1 changed file with 3 additions and 2 deletions.
diff --git a/src/subgraph.c b/src/subgraph.c
@@ -33,8 +33,9 @@ enum xnn_status xnn_insert_clamp_node(xnn_subgraph_t subgraph, float output_min,
   struct xnn_value* output_value = &subgraph->values[output_id];
   uint32_t new_id = XNN_INVALID_VALUE_ID;
   enum xnn_status status;
-  const size_t num_dims = output_value->shape.num_dims;
-  const size_t* dims = output_value->shape.dim;
+  size_t num_dims = output_value->shape.num_dims;
+  size_t dims[XNN_MAX_TENSOR_DIMS];
+  memcpy(dims, output_value->shape.dim, num_dims * sizeof(size_t));
   switch (output_value->datatype) {
     case xnn_datatype_fp16:
       status = xnn_define_tensor_value(