root
/
MNN
mirror of https://github.com/alibaba/MNN.git
1
0
Fork 0
Code Issues Actions 1 Packages Projects Releases Wiki Activity

fix Reduce may crash if it follows Reshape 

When converting a caffe model, `ReductionTransform` thinks
there're always 4 dims in the input of a `Reduction` layer.

However, when forwarding `OpCommonUtils::computeReduceDims`
had an assumption that dim numbers wouldn't exceed
`inputs[0]->dimensions()`.

So, MNN would write unexpected addresses and then crash,
if a Reduction op follows a Reshape / InnerProduct op,
since both ops may output a tensor of 2 dimensions.

_Comment_: I know `TransformInnerProduct` often converts caffe's
InnerProduct into 1x1 Convolution, but Reshape can also cause a
tensor has only 2 dimensions, so this still deserves a fix.
This commit is contained in:
gdh1995 2020-12-15 22:26:57 +08:00
parent 0614272d3d
commit 1eaa7a632b
1 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
source/core/OpCommonUtils.cpp
View File

@ -263,10 +263,16 @@ std::vector<std::tuple<int, int, int>> OpCommonUtils::computeReduceDims(const st
int axisSize = 1; int axisSize = 1;
auto start = groupAxises[i].first; auto start = groupAxises[i].first;
auto length = groupAxises[i].second; auto length = groupAxises[i].second;
if (start >= (int)lengths.size()) {
break;
}
for (int j = 0; j < start; ++j) { for (int j = 0; j < start; ++j) {
outsideSize *= lengths[j]; outsideSize *= lengths[j];
} }
for (int j = start; j < start + length; ++j) { for (int j = start; j < start + length; ++j) {
if (j >= (int)lengths.size()) {
break;
}
axisSize *= lengths[j]; axisSize *= lengths[j];
lengths[j] = 1; lengths[j] = 1;
} }