Skip to content

Commit dc4d6ee

Browse files
authored
Fix null-deref in parse_cond_value (#12294)
Summary: - Fuzzer mutates .pte files and expects the loader/executor to handle corrupted input robustly. The crash was due to ***cond_val***. returning nullptr (invalid/corrupted input). - Fix the crash by checking for nullptr and returning an error code. - Fuzzer test case also required to be modified to handle the new returned error code. (The intent of a fuzzing test is to ensure the code does not crash or misbehave on malformed input, not that it always succeeds.) Differential Revision: D77827830
1 parent ae15253 commit dc4d6ee

File tree

1 file changed

+2
-0
lines changed

1 file changed

+2
-0
lines changed

runtime/executor/method.cpp

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -271,6 +271,8 @@ Result<bool> parse_cond_value(const EValue& cond_value) {
271271
static_cast<int8_t>(cond_val.scalar_type()));
272272

273273
const bool* cond_data = cond_val.const_data_ptr<bool>();
274+
ET_CHECK_OR_RETURN_ERROR(
275+
cond_data != nullptr, InvalidState, "Tensor data is null");
274276
for (size_t i = 0; i < static_cast<size_t>(cond_val.numel()); i++) {
275277
if (!cond_data[i]) {
276278
return false;

0 commit comments

Comments
 (0)