From dce4dc8b20dcd2965ea4fb77c75ec6297efc540c Mon Sep 17 00:00:00 2001
From: CHEN YU <chenyu289@huawei.com>
Date: Wed, 7 Dec 2022 11:05:51 +0800
Subject: [PATCH] Add memory out-of-bounds check for InplaceOp's indices.

---
 .../ccsrc/plugin/device/cpu/kernel/in_place_op_cpu_kernel.cc  | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/mindspore/ccsrc/plugin/device/cpu/kernel/in_place_op_cpu_kernel.cc b/mindspore/ccsrc/plugin/device/cpu/kernel/in_place_op_cpu_kernel.cc
index 8f5430c64f6..a4f4bd7be09 100644
--- a/mindspore/ccsrc/plugin/device/cpu/kernel/in_place_op_cpu_kernel.cc
+++ b/mindspore/ccsrc/plugin/device/cpu/kernel/in_place_op_cpu_kernel.cc
@@ -128,6 +128,10 @@ class InplaceOpCpuTypeFunc : public CpuKernelFunc {
   int Resize(const BaseOperatorPtr &, const std::vector<KernelTensorPtr> &inputs, const std::vector<KernelTensorPtr> &,
              const std::map<uint32_t, tensor::TensorPtr> &) override {
     auto v_shape = inputs.at(kIndex1)->GetShapeVector();
+    if (v_shape.at(0) != SizeToLong(indices_.size())) {
+      MS_LOG(ERROR) << "For 'InplaceOp', the size of indices must equal to input_v's shape[0].";
+      return KRET_RESIZE_FAILED;
+    }
 
     // x_shape_.size() == v_shape.size() is checked at front end
     // x_shape_[1:] == v_shape[1:] is checked at front end