From ff47aabf3c397b328bae82f8da50cdd84d03ca99 Mon Sep 17 00:00:00 2001 From: Jens Elofsson Date: Mon, 23 Feb 2026 12:19:19 +0100 Subject: [PATCH] fix: Add index validation to CpuMaxUnpoolingLayerKernel * Resolves COMPMID-8700 Signed-off-by: Jens Elofsson Change-Id: Ib62f0deefd01e4e9f0c0fc6e85a042002abdd908 --- .../runtime/NEON/functions/NEMaxUnpoolingLayer.h | 4 ++-- src/cpu/kernels/maxunpool/generic/neon/impl.h | 12 ++++++++---- 2 files changed, 10 insertions(+), 6 deletions(-) diff --git a/arm_compute/runtime/NEON/functions/NEMaxUnpoolingLayer.h b/arm_compute/runtime/NEON/functions/NEMaxUnpoolingLayer.h index 2e5145988b6..2409d033da2 100644 --- a/arm_compute/runtime/NEON/functions/NEMaxUnpoolingLayer.h +++ b/arm_compute/runtime/NEON/functions/NEMaxUnpoolingLayer.h @@ -1,5 +1,5 @@ /* - * Copyright (c) 2020-2022, 2025 Arm Limited. + * Copyright (c) 2020-2022, 2025-2026 Arm Limited. * * SPDX-License-Identifier: MIT * @@ -76,7 +76,7 @@ class NEMaxUnpoolingLayer : public IFunction * * @param[in, out] input Source tensor. (Written to only when padding != 0) Data types supported: QASYMM8/QASYMM8_SIGNED/F16/F32. * @param[out] output Destination tensor. Data types supported: Same as @p input. - * @param[out] indices The indices of the maximal values. Data type supported: U32. + * @param[in] indices The indices of the maximal values. Data type supported: U32. * @param[in] pool_info Contains pooling operation information described in @ref PoolingLayerInfo. */ void configure(ITensor *input, ITensor *indices, ITensor *output, const PoolingLayerInfo &pool_info); diff --git a/src/cpu/kernels/maxunpool/generic/neon/impl.h b/src/cpu/kernels/maxunpool/generic/neon/impl.h index 73a5b86a2ff..38040cbe40d 100644 --- a/src/cpu/kernels/maxunpool/generic/neon/impl.h +++ b/src/cpu/kernels/maxunpool/generic/neon/impl.h @@ -1,5 +1,5 @@ /* - * Copyright (c) 2022-2023 Arm Limited. + * Copyright (c) 2022-2023, 2026 Arm Limited. * * SPDX-License-Identifier: MIT * @@ -27,6 +27,9 @@ #include "arm_compute/core/Window.h" #include "src/core/NEON/wrapper/wrapper.h" + +#include + namespace arm_compute { namespace cpu @@ -38,13 +41,14 @@ void max_unpooling(const ITensor *input, const ITensor *indices, ITensor *output Iterator indices_itr(indices, window); auto out_ptr = reinterpret_cast(output->buffer()); const int out_stride_w = static_cast(output->info()->strides_in_bytes()[3]); + uint32_t slice_size = output->info()->tensor_shape().total_size_lower(3); execute_window_loop( window, [&](const Coordinates &id) { - auto vindices = reinterpret_cast(indices_itr.ptr()); - auto vinput = reinterpret_cast(input_itr.ptr()); - out_ptr[id[3] * out_stride_w / sizeof(T) + *vindices] = *vinput; + auto vindices = reinterpret_cast(indices_itr.ptr()); + auto vinput = reinterpret_cast(input_itr.ptr()); + out_ptr[id[3] * out_stride_w / sizeof(T) + std::min(slice_size - 1, *vindices)] = *vinput; }, input_itr, indices_itr); }