In Tensorflow before version 2.4.0, an attacker can pass an invalid `axis` value to `tf.quantization.quantize_and_dequantize`. This results in accessing a dimension outside the rank of the input tensor in the C++ kernel implementation. However, dim_size only does a DCHECK to validate the argument and then uses it to access the corresponding element of an array. Since in normal builds, `DCHECK`-like macros are no-ops, this results in segfault and access out of bounds of the array. The issue is patched in eccb7ec454e6617738554a255d77f08e60ee0808 and TensorFlow 2.4.0 will be released containing the patch. TensorFlow nightly packages after this commit will also have the issue resolved.
cpe:2.3:a:google:tensorflow:*:*:*:*:-:*:*:*
837BA051-B044-46A7-BCDF-81785C1E1FF9
2.4.0
OR
**System information**
- Have I written custom code (as opposed to using a stock example script provided in TensorFlow): No
- OS Platform and Distribution (e.g., Linux Ubuntu 16.04): Linux Ubuntu 18.04
- Mobile device (e.g. iPhone 8, Pixel 2, Samsung Galaxy) if the issue happens on mobile device: N/A
- TensorFlow installed from (source or binary): binary
- TensorFlow version (use command below): v2.2.0-rc4-8-g2b96f3662b 2.2.0
- Python version: 3.7.6
- Bazel version (if compiling from source): N/A
- GCC/Compiler version (if compiling from source): N/A
- CUDA/cuDNN version: N/A
- GPU model and memory: N/A

**Describe the current behavior**
`tf.quantization.quantize_and_dequantize` produces a segfault  when `input` is a tensor in any shape of `float32` or `float64` and `axis` is specified to a large number. 

**Describe the expected behavior**
No segfault

**Standalone code to reproduce the issue**
```python
import tensorflow as tf
tf.quantization.quantize_and_dequantize(input=[2.5, 2.5], input_min=[0,0], input_max=[1,1], axis=10)
```

**Other info / logs** Include any logs or source code that would be helpful to
diagnose the problem. If including tracebacks, please include the full
traceback. Large logs and files should be attached.
`Segmentation fault (core dumped)`

Segmentation fault in tf.quantization.quantize_and_dequantize
This is a GitHub Issue
repo:tensorflow
owner:tensorflow
Title : Segmentation fault in tf.quantization.quantize_and_dequantize
Issue date:

--- start body ---
**System information**
- Have I written custom code (as opposed to using a stock example script provided in TensorFlow): No
- OS Platform and Distribution (e.g., Linux Ubuntu 16.04): Linux Ubuntu 18.04
- Mobile device (e.g. iPhone 8, Pixel 2, Samsung Galaxy) if the issue happens on mobile device: N/A
- TensorFlow installed from (source or binary): binary
- TensorFlow version (use command below): v2.2.0-rc4-8-g2b96f3662b 2.2.0
- Python version: 3.7.6
- Bazel version (if compiling from source): N/A
- GCC/Compiler version (if compiling from source): N/A
- CUDA/cuDNN version: N/A
- GPU model and memory: N/A

**Describe the current behavior**
`tf.quantization.quantize_and_dequantize` produces a segfault  when `input` is a tensor in any shape of `float32` or `float64` and `axis` is specified to a large number. 

**Describe the expected behavior**
No segfault

**Standalone code to reproduce the issue**
```python
import tensorflow as tf
tf.quantization.quantize_and_dequantize(input=[2.5, 2.5], input_min=[0,0], input_max=[1,1], axis=10)
```

**Other info / logs** Include any logs or source code that would be helpful to
diagnose the problem. If including tracebacks, please include the full
traceback. Large logs and files should be attached.
`Segmentation fault (core dumped)`

--- end body ---

comments :
--- start comments ---

--- end comments ---