google/XNNPACK

Possible null pointer dereference in logging

apach301 opened this issue · 0 comments

Hi,

I found some possible null pointer dereferences with Svace static analyzer.

  1. Possible dereference of NULL cache_provider in xnn_create_weights_cache_with_size():

    XNNPACK/src/runtime.c

    Lines 164 to 167 in f9bc6b4

    error:
    xnn_internal_release_weights_cache(cache_provider->context);
    return status;
    }

Bailing out occured with uninitialized cache_provider:

XNNPACK/src/runtime.c

Lines 131 to 143 in f9bc6b4

struct xnn_weights_cache_provider* cache_provider = NULL;
enum xnn_status status = xnn_status_uninitialized;
if ((xnn_params.init_flags & XNN_INIT_FLAG_XNNPACK) == 0) {
xnn_log_error("failed to create weights cache: XNNPACK is not initialized");
goto error;
}
cache_provider = xnn_allocate_zero_memory(sizeof(struct xnn_weights_cache_provider));
if (cache_provider == NULL) {
xnn_log_error("failed to allocate %zu bytes for weights cache provider descriptor", sizeof(struct xnn_weights_cache_provider));
goto error;
}

  1. Possible dereference of NULL resize_op in create_resize_bilinear2d_nhwc() during error logging:
    xnn_operator_t resize_op = NULL;
    enum xnn_status status = xnn_status_uninitialized;
    if ((xnn_params.init_flags & XNN_INIT_FLAG_XNNPACK) == 0) {
    xnn_log_error("failed to create %s operator: XNNPACK is not initialized",
    xnn_operator_type_to_string(operator_type));
    goto error;
    }
    status = xnn_status_invalid_parameter;
    if (output_width == 0 || output_height == 0) {
    xnn_log_error(
    "failed to reshape %s operator with %zux%zu output: output dimensions must be non-zero",
    xnn_operator_type_to_string(resize_op->type), output_width, output_height);
    return xnn_status_invalid_parameter;
    }
    if (max(output_width, output_height) >= 16777216) {
    xnn_log_error(
    "failed to reshape %s operator with %zux%zu output: output dimensions must be below 2**24",
    xnn_operator_type_to_string(resize_op->type), output_width, output_height);
    return xnn_status_unsupported_parameter;
    }