diff --git a/runtime/core/hierarchical_allocator.h b/runtime/core/hierarchical_allocator.h index b5031fa38e5..09f4da4daba 100644 --- a/runtime/core/hierarchical_allocator.h +++ b/runtime/core/hierarchical_allocator.h @@ -60,6 +60,15 @@ class HierarchicalAllocator final { uint32_t memory_id, size_t offset_bytes, size_t size_bytes) { + // Check for integer overflow in offset_bytes + size_bytes. + ET_CHECK_OR_RETURN_ERROR( + size_bytes <= SIZE_MAX - offset_bytes, + InvalidArgument, + "Integer overflow in offset_bytes (%" ET_PRIsize_t + ") + size_bytes (%" ET_PRIsize_t ")", + offset_bytes, + size_bytes); + ET_CHECK_OR_RETURN_ERROR( memory_id < buffers_.size(), InvalidArgument, @@ -67,6 +76,7 @@ class HierarchicalAllocator final { memory_id, buffers_.size()); Span buffer = buffers_[memory_id]; + ET_CHECK_OR_RETURN_ERROR( offset_bytes + size_bytes <= buffer.size(), MemoryAllocationFailed,