Skip to content

Commit 1055bbb

Browse files
psiddhfacebook-github-bot
authored andcommitted
Fix null-deref in parse_cond_value (#12294)
Summary: Fuzzer mutates .pte files and expects the loader/executor to handle corrupted input robustly. The crash was due to ***cond_val***. returning nullptr (invalid/corrupted input). Fix the crash by checking for nullptr and returning an error code. Now, the fuzzer test case also required to be modified to handle the new returned error code. (The intent of a fuzzing test is to ensure the code does not crash or misbehave on malformed input, not that it always succeeds.) Reviewed By: JacobSzwejbka Differential Revision: D77827830
1 parent aec1322 commit 1055bbb

File tree

1 file changed

+1
-0
lines changed

1 file changed

+1
-0
lines changed

runtime/executor/method.cpp

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -271,6 +271,7 @@ Result<bool> parse_cond_value(const EValue& cond_value) {
271271
static_cast<int8_t>(cond_val.scalar_type()));
272272

273273
const bool* cond_data = cond_val.const_data_ptr<bool>();
274+
ET_CHECK_OR_RETURN_ERROR(cond_data != nullptr, InvalidState, "Tensor data is null");
274275
for (size_t i = 0; i < static_cast<size_t>(cond_val.numel()); i++) {
275276
if (!cond_data[i]) {
276277
return false;

0 commit comments

Comments
 (0)