fix fuzz

mindspore/ccsrc/backend/kernel_compiler/cpu/nnacl/infer/gather_infer.c

@@ -23,7 +23,8 @@ int GatherInferShape(const TensorC *const *inputs, size_t inputs_size, TensorC *
   if (ret != NNACL_OK) {
     return ret;
   }
-  if (inputs_size < 2 || outputs_size != 1) {
+  const size_t kMinimumGradInputsNum = 3;
+  if (inputs_size < kMinimumGradInputsNum || outputs_size != 1) {
     return NNACL_ERR;
   }
   const TensorC *input = inputs[0];

mindspore/lite/src/lite_model.cc

@@ -324,6 +324,7 @@ bool LiteModel::ModelVerify() const {
     MS_LOG(ERROR) << "Graph output indices is beyond tensor_size.";
     return false;
   }
+
   return NodeVerify() == RET_OK && SubGraphVerify() == RET_OK;
 }
 

mindspore/lite/src/runtime/kernel/arm/fp32/gatherNd_fp32.cc

@@ -73,14 +73,22 @@ int GatherNdCPUKernel::ReSize() {
   return RET_OK;
 }
 
-void GatherNdCPUKernel::InitOffset() {
+int GatherNdCPUKernel::InitOffset() {
   MS_ASSERT(in_offset_ != nullptr);
   auto indices_tensor = in_tensors_.at(1);
   auto indices_shape = indices_tensor->shape();
   auto in_shape = in_tensors_.front()->shape();
   int indices_rank = indices_shape.size();
   int in_rank = in_shape.size();
+  if (indices_rank < 1) {
+    MS_LOG(ERROR) << name() << " indices shape size must be greater than or equal to 1!";
+    return RET_ERROR;
+  }
   int idx_lastshape = indices_shape[indices_rank - 1];
+  if (idx_lastshape > in_rank) {
+    MS_LOG(ERROR) << name() << " indices shape error!";
+    return RET_ERROR;
+  }
   auto indices_ptr = reinterpret_cast<int *>(indices_tensor->data());
   MS_ASSERT(indices_ptr != nullptr);
   area_ = 1;
@@ -97,9 +105,15 @@ void GatherNdCPUKernel::InitOffset() {
   (void)memset(in_offset_, 0, count_ * sizeof(int));
   for (int j = 0; j < count_; ++j) {
     for (int k = 0; k < idx_lastshape; ++k) {
-      in_offset_[j] += indices_ptr[j * idx_stride + k] * in_stride.at(k);
+      if (indices_ptr[j * idx_stride + k] < in_shape[k]) {
+        in_offset_[j] += indices_ptr[j * idx_stride + k] * in_stride.at(k);
+      } else {
+        MS_LOG(ERROR) << name() << " indices value invalid!";
+        return RET_ERROR;
+      }
     }
   }
+  return RET_OK;
 }
 
 int GatherNdCPUKernel::DoGatherNd(int task_id) const {
@@ -131,7 +145,10 @@ int GatherNdCPUKernel::Run() {
   out_ptr_ = reinterpret_cast<float *>(out_tensors_.front()->data());
   CHECK_NULL_RETURN(in_ptr_);
   CHECK_NULL_RETURN(out_ptr_);
-  InitOffset();
+  if (InitOffset() != RET_OK) {
+    MS_LOG(ERROR) << "InitOffset failed.";
+    return RET_ERROR;
+  }
   auto ret = ParallelLaunch(this->ms_context_, GatherNdRun, this, thread_sz_count_);
   if (ret != RET_OK) {
     MS_LOG(ERROR) << "gatherNd error error_code[" << ret << "]";

mindspore/lite/src/runtime/kernel/arm/fp32/gatherNd_fp32.h

@@ -40,7 +40,7 @@ class GatherNdCPUKernel : public InnerKernel {
   int DoGatherNd(int task_id) const;
 
  private:
-  void InitOffset();
+  int InitOffset();
   int thread_sz_count_ = 0;
   int thread_sz_stride_ = 0;
   int count_ = 0;

mindspore/lite/src/runtime/kernel/arm/int8/gatherNd_int8.cc

@@ -89,10 +89,14 @@ int GatherNdInt8CPUKernel::InitOffset() {
   auto in_shape = in_tensors_.front()->shape();
   int in_rank = static_cast<size_t>(in_shape.size());
   if (indices_rank < 1) {
-    MS_LOG(ERROR) << "inex out of bounds";
+    MS_LOG(ERROR) << "index out of bounds";
     return RET_ERROR;
   }
   int idx_lastshape = indices_shape.at(indices_rank - 1);
+  if (idx_lastshape > in_rank) {
+    MS_LOG(ERROR) << name() << " indices shape error!";
+    return RET_ERROR;
+  }
   auto indices_ptr = reinterpret_cast<int8_t *>(indices_tensor->data());
   CHECK_NULL_RETURN(indices_ptr);
   area_ = 1;
@@ -110,7 +114,12 @@ int GatherNdInt8CPUKernel::InitOffset() {
     for (int k = 0; k < idx_lastshape; ++k) {
       int tmp = static_cast<int>(
         round((indices_ptr[j * idx_stride + k] - ind_quant_args.front().zeroPoint) * ind_quant_args.front().scale));
-      in_offset_[j] += tmp * in_stride[k];
+      if (tmp < in_shape[k]) {
+        in_offset_[j] += tmp * in_stride[k];
+      } else {
+        MS_LOG(ERROR) << name() << " indices value invalid!";
+        return RET_ERROR;
+      }
     }
   }
   return RET_OK;
@@ -147,6 +156,7 @@ int GatherNdInt8CPUKernel::Run() {
   CHECK_NULL_RETURN(out_ptr_);
   auto ret = InitOffset();
   if (ret != RET_OK) {
+    MS_LOG(ERROR) << "InitOffset failed.";
     return ret;
   }
   ret = ParallelLaunch(this->ms_context_, GatherNdInt8Run, this, thread_sz_count_);

mindspore/lite/test/ut/src/registry/registry_gpu_custom_op_test.cc

@@ -156,12 +156,19 @@ struct GpuTensorInfo {
 class CustomAddKernel : public kernel::Kernel {
  public:
   CustomAddKernel(const std::vector<MSTensor> &inputs, const std::vector<MSTensor> &outputs,
-                  const schema::Primitive *primitive, const mindspore::Context *ctx, const std::string &build_options,
-                  bool fp16_enable)
-      : Kernel(inputs, outputs, primitive, ctx), build_options_(build_options), fp16_enable_(fp16_enable) {}
+                  const schema::Primitive *primitive, const mindspore::Context *ctx, bool fp16_enable)
+      : Kernel(inputs, outputs, primitive, ctx), fp16_enable_(fp16_enable) {}
   ~CustomAddKernel() override { FreeWeight(); }
+
+  int CheckInputsDataTypes() { return lite::RET_OK; }
+
   // Prepare will be called during graph compilation
   int Prepare() override {
+    auto ret = CheckSpecs();
+    if (ret != lite::RET_OK) {
+      std::cerr << "Prepare failed for check kernel specs!";
+      return ret;
+    }
     const std::string kernel_name_ = "ElementAdd";
     const std::string program_name = "Arithmetic";
     std::string source = arithmetic_source;
@@ -170,8 +177,12 @@ class CustomAddKernel : public kernel::Kernel {
       return lite::RET_ERROR;
     }
     std::vector<std::string> build_options_ext = {"-cl-mad-enable -cl-fast-relaxed-math -Werror"};
+    if (fp16_enable_) {
+      build_options_ext.push_back(" -DFLT4=half4 -DWRITE_IMAGE=write_imageh -DREAD_IMAGE=read_imageh");
+    } else {
+      build_options_ext.push_back(" -DFLT4=float4 -DWRITE_IMAGE=write_imagef -DREAD_IMAGE=read_imagef");
+    }
 
-    build_options_ext.push_back(build_options_);
     if (opencl_runtime_.BuildKernel(&kernel_, program_name, kernel_name_, build_options_ext) != kSuccess) {
       std::cerr << "Build kernel failed.";
       return lite::RET_ERROR;
@@ -182,8 +193,8 @@ class CustomAddKernel : public kernel::Kernel {
     global_range_ = cl::NDRange(out_shape.width, out_shape.height);
     for (int i = 0; i < inputs_.size(); ++i) {
       auto &in_tensor = inputs_.at(i);
-      GpuTensorInfo in_shape = GpuTensorInfo(&in_tensor, &opencl_runtime_);
       if (in_tensor.IsConst()) {
+        GpuTensorInfo in_shape = GpuTensorInfo(&in_tensor, &opencl_runtime_);
         std::vector<char> weight(in_shape.Image2DSize, 0);
         bool src_is_fp16 = in_tensor.DataType() == mindspore::DataType::kNumberTypeFloat16;
         PackNHWCToNHWC4(in_tensor.MutableData(), weight.data(), src_is_fp16, fp16_enable_, in_shape,
@@ -274,6 +285,19 @@ class CustomAddKernel : public kernel::Kernel {
       return lite::RET_ERROR;
     }
 
+    for (int i = 0; i < inputs_.size(); ++i) {
+      auto &in_tensor = inputs_.at(i);
+      if (!in_tensor.IsConst()) {
+        if (fp16_enable_ && in_tensor.DataType() == mindspore::DataType::kNumberTypeFloat32) {
+          std::cerr << "Inputs data type error, expectation kNumberTypeFloat16 but kNumberTypeFloat32.";
+          return lite::RET_ERROR;
+        } else if (!fp16_enable_ && in_tensor.DataType() == mindspore::DataType::kNumberTypeFloat16) {
+          std::cerr << "Inputs data type error, expectation kNumberTypeFloat32 but kNumberTypeFloat16.";
+          return lite::RET_ERROR;
+        }
+      }
+    }
+
     return lite::RET_OK;
   }
 
@@ -288,12 +312,7 @@ class CustomAddKernel : public kernel::Kernel {
       std::cerr << "infer failed." << std::endl;
       return lite::RET_ERROR;
     }
-    auto ret = CheckSpecs();
-    if (ret != lite::RET_OK) {
-      std::cerr << "ReSize failed for check kernel specs!";
-      return ret;
-    }
-    ret = Prepare();
+    auto ret = Prepare();
     if (ret != lite::RET_OK) {
       std::cerr << "ReSize failed for kernel prepare!";
       return ret;
@@ -302,8 +321,7 @@ class CustomAddKernel : public kernel::Kernel {
   }
 
  private:
-  std::string build_options_;
-  bool fp16_enable_;
+  const bool fp16_enable_;
   cl::Kernel kernel_;
   cl::Event event_;
   cl::NDRange global_range_{cl::NullRange};
@@ -412,11 +430,10 @@ namespace {
 std::shared_ptr<kernel::Kernel> CustomAddCreator(const std::vector<MSTensor> &inputs,
                                                  const std::vector<MSTensor> &outputs,
                                                  const schema::Primitive *primitive, const mindspore::Context *ctx) {
-  const std::string build_options = " -DFLT4=float4 -DWRITE_IMAGE=write_imagef -DREAD_IMAGE=read_imagef ";
   bool fp16_enable = false;
 
   std::cout << "using fp32 add.\n" << std::endl;
-  return std::make_shared<CustomAddKernel>(inputs, outputs, primitive, ctx, build_options, fp16_enable);
+  return std::make_shared<CustomAddKernel>(inputs, outputs, primitive, ctx, fp16_enable);
 }
 
 std::shared_ptr<kernel::KernelInterface> CustomAddInferCreator() { return std::make_shared<CustomAddInfer>(); }