Crash in `tf.raw_ops.UnsortedSegmentJoin/UnsortedSegmentMin/UnsortedSegmentMax/UnsortedSegmentProd/UnsortedSegmentSum`

[x0w3n]

Crash in `tf.raw_ops.UnsortedSegmentJoin/UnsortedSegmentMin/UnsortedSegmentMax/UnsortedSegmentProd/UnsortedSegmentSum`

[tilakrayal]

@x0w3n,
For UnsortedSegmentProd, we have below logic implemented and also reason for different implementation on CPU and GPU is:
num_segments should equal the number of distinct segment IDs.
On CPU, values in segment_ids are always validated to be less than num_segments, and an error is thrown
for out-of-bound indices.
On GPU, this does not throw an error for out-of-bound indices. On Gpu, out-of-bound indices result in safe but unspecified behavior, which may include ignoring out-of-bound indices or outputting a tensor with a 0 stored in the first
dimension of its shape if num_segments is 0.

Also Your example is similar to malloc(a_huge_number) written by a programmer in their own code. This has exactly one effect: self-caused denial of service. Also, in this case, this is a user-caused DOS, not something that results from a very small input getting unpacked into something large (as it would be the case in a tar bomb for example, though even there we no longer care about these if they don't manifest in real world models)

[github-actions]

This issue is stale because it has been open for 7 days with no activity. It will be closed if no further activity occurs. Thank you.

[github-actions]

This issue was closed because it has been inactive for 7 days since being marked as stale. Please reopen if you'd like to work on this further.

[google-ml-butler]

Are you satisfied with the resolution of your issue?
Yes
No