From 12c48688eed6e98e168a8f4fe49310f87a2ce99c Mon Sep 17 00:00:00 2001
From: Nashit-h <nashit@bugqore.com>
Date: Fri, 17 Jul 2026 11:37:38 +0530
Subject: [PATCH] check serialized vector lengths before indexing in
 deserializer

---
 src/Deserialization.cpp | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/src/Deserialization.cpp b/src/Deserialization.cpp
index bca082683e70..fe31c30a8a58 100644
--- a/src/Deserialization.cpp
+++ b/src/Deserialization.cpp
@@ -942,6 +942,9 @@ std::vector<Expr> Deserializer::deserialize_expr_vector(const flatbuffers::Vecto
                                                         const flatbuffers::Vector<flatbuffers::Offset<void>> *exprs_serialized) {
     user_assert(exprs_types != nullptr);
     user_assert(exprs_serialized != nullptr);
+    user_assert(exprs_types->size() == exprs_serialized->size())
+        << "deserialized expr vector carries " << exprs_serialized->size()
+        << " exprs, but " << exprs_types->size() << " type codes\n";
     std::vector<Expr> result;
     result.reserve(exprs_serialized->size());
     for (size_t i = 0; i < exprs_serialized->size(); ++i) {
@@ -1163,6 +1166,9 @@ FuseLoopLevel Deserializer::deserialize_fuse_loop_level(const Serialize::FuseLoo
     for (const auto &align_strategy : *fuse_loop_level->align_strategies()) {
         align_strategies.push_back(deserialize_loop_align_strategy((Serialize::LoopAlignStrategy)align_strategy));
     }
+    user_assert(align_dimension_names.size() == align_strategies.size())
+        << "deserialized fuse loop level carries " << align_dimension_names.size()
+        << " align dimension names, but " << align_strategies.size() << " align strategies\n";
     std::map<std::string, LoopAlignStrategy> align;
     for (size_t i = 0; i < align_dimension_names.size(); ++i) {
         align[align_dimension_names[i]] = align_strategies[i];
@@ -1311,6 +1317,10 @@ Buffer<> Deserializer::deserialize_buffer(const Serialize::Buffer *buffer) {
     const std::string name = deserialize_string(buffer->name());
     const auto type = deserialize_type(buffer->type());
     const int32_t dimensions = buffer->dimensions();
+    user_assert(buffer->dims() != nullptr) << "deserialized buffer " << name << " has no dims\n";
+    user_assert(dimensions >= 0 && (size_t)dimensions == buffer->dims()->size())
+        << "deserialized buffer " << name << " declares " << dimensions
+        << " dimensions, but carries " << buffer->dims()->size() << " of them\n";
     std::vector<halide_dimension_t> hl_buffer_dimensions;
     std::vector<halide_dimension_t> dense_buffer_dimensions;
     hl_buffer_dimensions.reserve(dimensions);
@@ -1473,6 +1483,10 @@ Pipeline Deserializer::deserialize(const std::vector<uint8_t> &data) {
     }
 
     std::vector<Func> funcs;
+    user_assert(pipeline_obj->funcs() != nullptr) << "deserialized pipeline has no funcs\n";
+    user_assert(pipeline_obj->funcs()->size() == functions.size())
+        << "deserialized pipeline carries " << pipeline_obj->funcs()->size()
+        << " funcs, but " << functions.size() << " func names\n";
     for (size_t i = 0; i < pipeline_obj->funcs()->size(); ++i) {
         deserialize_function(pipeline_obj->funcs()->Get(i), functions[i]);
         funcs.emplace_back(functions[i]);