From be152cfc3168a4f6bc75d1735c3eb45a0b208457 Mon Sep 17 00:00:00 2001
From: luoyuan <luoyuan7@huawei.com>
Date: Fri, 23 Sep 2022 13:06:05 +0800
Subject: [PATCH] [MS][LITE][r1.9] fuzz fix 0923

---
 mindspore/lite/src/litert/kernel/cpu/base/split_base.cc  | 9 +++++++++
 mindspore/lite/src/litert/kernel/cpu/base/tile_base.cc   | 7 +++++++
 .../src/litert/kernel/cpu/fp32/embedding_lookup_fp32.cc  | 5 +++++
 3 files changed, 21 insertions(+)

diff --git a/mindspore/lite/src/litert/kernel/cpu/base/split_base.cc b/mindspore/lite/src/litert/kernel/cpu/base/split_base.cc
index 94af9373a7c..cb4c8c160c1 100644
--- a/mindspore/lite/src/litert/kernel/cpu/base/split_base.cc
+++ b/mindspore/lite/src/litert/kernel/cpu/base/split_base.cc
@@ -78,6 +78,15 @@ int SplitBaseCPUKernel::CheckAndInitSplitParam(const lite::Tensor &in_tensor, Sp
     for (int i = 0; i < param->num_split_; i++) {
       param->split_sizes_[i] = split_size;
     }
+  } else {
+    int64_t split_sizes_sum = 0;
+    for (int i = 0; i < param->num_split_; i++) {
+      split_sizes_sum += param->split_sizes_[i];
+    }
+    if (split_sizes_sum > input_shape[param->split_dim_]) {
+      MS_LOG(ERROR) << "Customer-based split sizes is not usable.";
+      return RET_ERROR;
+    }
   }
 
   if (param->split_sizes_[param->num_split_ - 1] == -1) {
diff --git a/mindspore/lite/src/litert/kernel/cpu/base/tile_base.cc b/mindspore/lite/src/litert/kernel/cpu/base/tile_base.cc
index cdaf5eeb2fc..fcd1630bc87 100644
--- a/mindspore/lite/src/litert/kernel/cpu/base/tile_base.cc
+++ b/mindspore/lite/src/litert/kernel/cpu/base/tile_base.cc
@@ -75,6 +75,13 @@ int TileCPUKernel::ReSize() {
   ComputeStrides(tile_parameter_->in_shape_, tile_parameter_->in_strides_, tile_parameter_->in_dim_);
   ComputeStrides(tile_parameter_->out_shape_, tile_parameter_->out_strides_, tile_parameter_->in_dim_);
 
+  for (size_t i = 0; i < tile_parameter_->dims_size_; i++) {
+    MS_CHECK_FALSE(INT_MUL_OVERFLOW(tile_parameter_->multiples_[i], tile_parameter_->in_shape_[i]),
+                   NNACL_ERRCODE_MUL_OVERFLOW);
+    auto ele_num = tile_parameter_->multiples_[i] * tile_parameter_->in_shape_[i] - 1;
+    MS_CHECK_FALSE(INT_MUL_OVERFLOW(tile_parameter_->out_strides_[i], ele_num), NNACL_ERRCODE_MUL_OVERFLOW);
+  }
+
   auto data_type = in_tensors_.at(0)->data_type();
   if (data_type == kNumberTypeFloat32 || data_type == kNumberTypeInt32) {
     tile_parameter_->data_size_ = sizeof(float);
diff --git a/mindspore/lite/src/litert/kernel/cpu/fp32/embedding_lookup_fp32.cc b/mindspore/lite/src/litert/kernel/cpu/fp32/embedding_lookup_fp32.cc
index cfc63630859..0185373c82e 100644
--- a/mindspore/lite/src/litert/kernel/cpu/fp32/embedding_lookup_fp32.cc
+++ b/mindspore/lite/src/litert/kernel/cpu/fp32/embedding_lookup_fp32.cc
@@ -28,6 +28,11 @@ int EmbeddingLookupCPUKernel::Prepare() {
   CHECK_LESS_RETURN(in_tensors_.size(), 1);
   CHECK_LESS_RETURN(out_tensors_.size(), 1);
   CHECK_NULL_RETURN(param_);
+  auto ids_data_type = in_tensors_.back()->data_type();
+  if (ids_data_type != kNumberTypeInt32 && ids_data_type != kNumberTypeInt64) {
+    MS_LOG(ERROR) << "embedding_lookup not support input_indices data type: " << ids_data_type;
+    return RET_ERROR;
+  }
   if (!InferShapeDone()) {
     return RET_OK;
   }