TensorFlow 1.7.1 has been released , and the release notes show that this version fixes some potential security issues:
TensorFlow Lite TOCO compiler does not perform correct bounds checking when reading from certain fields in TFLite files
The block size in the metafile may contain a large int64 value, which would cause an integer overflow when appending. Subsequent code using n as an index may result in an out-of-bounds read
The TensorFlow checkpoint metafile uses Google's https://github.com/google/snappy compression/decompression library, and the snappy version currently used by TensorFlow has a memcpy-param overlap issue
A maliciously crafted configuration file passed to the TensorFlow XLA compiler could lead to invalid memory accesses, or concurrent heap buffer overflows
It can be seen that some boundary condition judgments, memory overflows and other issues are involved.
Source code download