Fix parse-side recursion gap in CVE-2025-0649 (GetDenseTensorShape / FillTensorProto)

[rishuranjanofficial]

Summary

CVE-2025-0649 (uncontrolled recursion in GetDenseTensorShape and
FillTensorProto, CVSS 7.5 HIGH) was reported against
tensorflow_serving/util/json_tensor.cc. The prior fix attempt (#4133,
closed without merge) only addressed the stringification side of this bug
class — the parse-side recursion in GetDenseTensorShape/FillTensorProto
remains unbounded on current master.

This was independently confirmed by a reviewer on #4143 (the OSS-Fuzz
harness for this same parser), who reproduced a real ASAN stack-overflow
using a 250,000-level nested JSON request body:
$ python3 infra/helper.py reproduce tensorflow-serving json_tensor_fuzzer /tc.json
==ERROR: AddressSanitizer: stack-overflow ...
#0 tensorflow::serving::FillTensorProto(...)
... (249 recursive frames total, truncated)
SUMMARY: AddressSanitizer: stack-overflow .../json_tensor.cc:393 in FillTensorProto

An unauthenticated attacker can crash tensorflow_model_server with a
single deeply nested JSON request to the REST API (/v1/models/*:predict,
:classify, or :regress).

Related prior art

• [Security] Fix CVE-2025-0649: Memory corruption in JSON parsing #4133 — original CVE fix attempt, closed without merging.
• Fix stack exhaustion DoS in json parsing via iterative shape traversal #4138 — a separate open PR proposing a similar iterative-rewrite fix,
  unreviewed for ~3 months. This PR takes a different, smaller-diff approach
  (bounded recursion instead of an iterative rewrite) but addresses the same
  root cause.
• **CVE-2025-0649** - I think this issue still exists in version 2.19.0 - At least my lab suggests it is. #4116 — original public report of the crash.
• Add OSS-Fuzz harness for JSON tensor REST API parser #4143 — OSS-Fuzz harness for this parser, whose review surfaced this gap.

Fix

• Added kMaxTensorRank = 254 (aligned with TensorFlow's
  TensorShape::MaxDimensions()).
• GetDenseTensorShape now returns absl::Status and rejects input nested
  deeper than kMaxTensorRank, instead of recursing without bound. All three
  call sites updated to propagate the new return value.
• FillTensorProto gets an independent depth guard as defense-in-depth,
  since it was called out as its own recursion vector.
• Added regression tests: deeply nested instances and inputs payloads are
  now rejected with InvalidArgument, and a well-within-limit nested payload
  is confirmed to still succeed (no legitimate-use-case regression).

Testing

Added DeeplyNestedInstancesRejected, DeeplyNestedInputsRejected, and
WellFormedNestedInstancesWithinLimitAccepted to json_tensor_test.cc.