Fix stack buffer overflows in ynnpack channelwise quantized tensor and reduce

[mohammadmseet-hue]

Summary

Two stack buffer overflows in ynnpack:

Bug 1: Stack buffer overflow in xnn_define_channelwise_quantized_tensor_value_v3

File: ynnpack/xnnpack/tensor.cc:146

std::copy_n(dims, channel_dim + 1, quantization_dims) copies channel_dim + 1 elements into quantization_dims[YNN_MAX_TENSOR_RANK] (size 8) without checking channel_dim < num_dims or channel_dim < YNN_MAX_TENSOR_RANK. Additionally, xnn_validate_channelwise_quantized_tensor (line 112-116) is empty (return xnn_status_success).

With channel_dim >= 8, this writes past the end of the stack buffer — 88 bytes of controlled overflow confirmed.

ASAN output:

==ERROR: AddressSanitizer: stack-buffer-overflow
WRITE of size 88
    #0 memmove
    #8 xnn_define_channelwise_quantized_tensor_value_v3
[96, 160) 'quantization_dims' (line 145) <== Memory access at offset 160 overflows this variable

Reachable from public API: xnn_define_channelwise_quantized_tensor_value(), xnn_define_channelwise_quantized_tensor_value_v2(), xnn_define_channelwise_quantized_tensor_value_v3().

Fix: Add channel_dim >= num_dims || num_dims > YNN_MAX_TENSOR_RANK check before the std::copy_n.

Bug 2: Stack buffer overflow in get_reduce_identity_value

File: ynnpack/subgraph/reduce.cc:243

For ynn_reduce_min_max with keep_dims=true on a rank-8 tensor, output.extents.push_back(2) (line 345) increases the output rank to 9. Then get_reduce_identity_value computes rank = output.rank() = 9 and accesses dims[rank - 1] = dims[8], writing one element past the size_t dims[YNN_MAX_TENSOR_RANK] (size 8) stack array.

Fix: Add rank bounds check in the ynn_reduce_min_max case before accessing dims[rank - 1].