WIP - Security hits solved

.github/workflows/codeql.yml

@@ -2,6 +2,7 @@ name: "CodeQL Advanced"
 
 on:
   workflow_dispatch:
+  pull_request:
   push:
     branches:
       - develop

.gitmodules

@@ -3,13 +3,13 @@
 	url = https://github.com/google/flatbuffers.git
 [submodule "thirdparty/elf"]
 	path = thirdparty/elf
-	url = https://github.com/openvinotoolkit/npu_plugin_elf.git
+	url = https://github.com/DariaMityagina/vpux_plugin_elf.git
 [submodule "thirdparty/llvm-project"]
 	path = thirdparty/llvm-project
 	url = https://github.com/intel/npu-plugin-llvm.git
 [submodule "thirdparty/vpucostmodel"]
 	path = thirdparty/vpucostmodel
-	url = https://github.com/intel/npu-nn-cost-model.git
+	url = https://github.com/DariaMityagina/npu-nn-cost-model.git
 [submodule "thirdparty/yaml-cpp"]
 	path = thirdparty/yaml-cpp
 	url = https://github.com/jbeder/yaml-cpp

src/vpux_compiler/src/bitc/src/Encoder.cpp

@@ -756,7 +756,8 @@ void Encoder::Impl::encode(const BitCompactorConfig& config, const std::vector<u
     const auto last_block_elements{input_bytes - (input_blocks << 6)};
     uint32_t last_block{static_cast<uint32_t>(last_block_elements > 0u)};
 
-    std::vector<AlgorithmParam> block_params(input_blocks * ALGORITHMS);
+    std::size_t total_blocks = static_cast<std::size_t>(input_blocks) * static_cast<std::size_t>(ALGORITHMS);
+    std::vector<AlgorithmParam> block_params(total_blocks);
     std::vector<BitStream> block_stream(input_blocks + last_block);
 
     if (config.mode_fp16_enable) {

src/vpux_compiler/src/dialect/IE/utils/interpolate_utils.cpp

@@ -160,7 +160,7 @@ SmallVector<int64_t> inferOutputShapeWithScalesMode(ShapeRef inputShape, ArrayRe
     auto scalesIter = scalesVal.begin();
     for (const auto& axis : axesVal) {
         outputShape[axis] =
-                static_cast<int64_t>(floor(static_cast<StorageType>(*scalesIter++) * inputShape[Dim(axis)]));
+                static_cast<int64_t>(floor(static_cast<double>(static_cast<StorageType>(*scalesIter++) * inputShape[Dim(axis)])));
         log.trace("Infer Scales mode at axis {0}: {1} -> {2}", axis, inputShape[Dim(axis)], outputShape[axis]);
     }
     return outputShape;

src/vpux_compiler/src/dialect/VPUIP/transforms/passes/dump_statistics_of_task_ops.cpp

@@ -518,7 +518,7 @@ class CompressionRateCounter {
                     convertBytesToReadableSize(compressedF16constantsAfterCompression_),
                     (double)compressedF16constantsAfterCompression_ / compressedF16constantsBeforeCompression_ * 100);
         }
-        if (compressedConstantsCounter_ - compressedF16constantsCounter_ > 0) {
+        if (compressedConstantsCounter_ > compressedF16constantsCounter_) {
             log.nest().info(
                     "Int8 - count: {0}, size: {1}, compressed size: {2}, ({3}%)",
                     compressedConstantsCounter_ - compressedF16constantsCounter_,

src/vpux_compiler/src/dialect/VPUIP/transforms/passes/patch_populate_weight_table_with_shave.cpp

@@ -157,7 +157,7 @@ void PatchPopulateWeightTableWithShavePass::patchShaveForPopulateWeightTable(VPU
             const auto offsetsAttr = subView.getStaticOffsets();
             auto offsets = parseIntArrayAttr<int32_t>(offsetsAttr);
             _log.trace("offset {0}", offsets);
-            swKernelRunOffsets.push_back(offsets[0] * weightAddressOffset);
+            swKernelRunOffsets.push_back(static_cast<int64_t>(offsets[0]) * static_cast<int64_t>(weightAddressOffset));
         } else {
             swKernelRunOffsets.push_back(0);
         }