Fix integer overflow and null dereference

Resolves: COMPMID-4527

Change-Id: If038d2477d8898d3ee307fe58301fb0b16b64c02
Signed-off-by: Michalis Spyrou <michalis.spyrou@arm.com>
Reviewed-on: https://review.mlplatform.org/c/ml/ComputeLibrary/+/5640
Reviewed-by: Michele Di Giorgio <michele.digiorgio@arm.com>
Comments-Addressed: Arm Jenkins <bsgcomp@arm.com>
Tested-by: Arm Jenkins <bsgcomp@arm.com>

3 files changed, 9 insertions, 6 deletions

diff --git a/src/core/CL/kernels/CLInstanceNormalizationLayerKernel.cpp b/src/core/CL/kernels/CLInstanceNormalizationLayerKernel.cpp
index dcde0850a7..323579dc3c 100644
--- a/src/core/CL/kernels/CLInstanceNormalizationLayerKernel.cpp
+++ b/src/core/CL/kernels/CLInstanceNormalizationLayerKernel.cpp
@@ -108,11 +108,11 @@ void CLComputeMeanVariance::configure(const CLCompileContext &compile_context, I
     // Output auto initialization if not yet initialized
     if(use_mixed_precision)
     {
-        auto_init_if_empty(*output->info(), out_shape, 1, DataType::F32);
+        auto_init_if_empty(*_output->info(), out_shape, 1, DataType::F32);
     }
     else
     {
-        auto_init_if_empty(*output->info(), out_shape, 1, input->info()->data_type());
+        auto_init_if_empty(*_output->info(), out_shape, 1, input->info()->data_type());
     }
     ICLKernel::configure_internal(win);
     ARM_COMPUTE_ERROR_ON(has_padding_changed(padding_info));
diff --git a/src/core/cpu/kernels/CpuMulKernel.cpp b/src/core/cpu/kernels/CpuMulKernel.cpp
index dabf656e6e..82ec322875 100644
--- a/src/core/cpu/kernels/CpuMulKernel.cpp
+++ b/src/core/cpu/kernels/CpuMulKernel.cpp
@@ -846,7 +846,7 @@ void mul_S32_S32_S32(const ITensor *src1, const ITensor *src2, ITensor *out, con
                 }
                 else
                 {
-                    uint64_t mask = (1u << n) - 1;
+                    uint64_t mask = ((uint64_t)1u << n) - 1;
                     tmp           = (tmp + static_cast<int64_t>(mask)) >> n;
                 }
                 if(is_sat)
@@ -909,7 +909,7 @@ void mul_S32_S32_S32(const ITensor *src1, const ITensor *src2, ITensor *out, con
                 }
                 else
                 {
-                    uint64_t mask = (1u << n) - 1;
+                    uint64_t mask = ((uint64_t)1u << n) - 1;
                     tmp           = (tmp + static_cast<int64_t>(mask)) >> n;
                 }
                 if(is_sat)
diff --git a/src/core/cpu/kernels/CpuScaleKernel.cpp b/src/core/cpu/kernels/CpuScaleKernel.cpp
index c533e9ab8a..ed7517111f 100644
--- a/src/core/cpu/kernels/CpuScaleKernel.cpp
+++ b/src/core/cpu/kernels/CpuScaleKernel.cpp
@@ -178,8 +178,11 @@ Status validate_arguments(const ITensorInfo *src, const ITensorInfo *dx, const I
     if(info.interpolation_policy == InterpolationPolicy::BILINEAR)
     {
         ARM_COMPUTE_RETURN_ERROR_ON_DATA_TYPE_CHANNEL_NOT_IN(offsets, 1, DataType::S32);
-        ARM_COMPUTE_RETURN_ERROR_ON_DATA_TYPE_CHANNEL_NOT_IN(dx, 1, DataType::F32);
-        ARM_COMPUTE_RETURN_ERROR_ON_DATA_TYPE_CHANNEL_NOT_IN(dy, 1, DataType::F32);
+        if(dx != nullptr && dy != nullptr)
+        {
+            ARM_COMPUTE_RETURN_ERROR_ON_DATA_TYPE_CHANNEL_NOT_IN(dx, 1, DataType::F32);
+            ARM_COMPUTE_RETURN_ERROR_ON_DATA_TYPE_CHANNEL_NOT_IN(dy, 1, DataType::F32);
+        }
     }
 
     ARM_COMPUTE_RETURN_ERROR_ON(info.align_corners && !scale_utils::is_align_corners_allowed_sampling_policy(info.sampling_policy));