Heap buffer overflow in LiteralProto materialization via tuple-leaf layout.element_size_in_bits mismatch

[Omar-Khaleel]

Summary

A malformed LiteralProto can trigger a heap buffer overflow during XLA literal materialization when a tuple-contained leaf array retains a custom non-zero layout.element_size_in_bits value.

Root cause

Literal::SetShape canonicalized custom element sizes only for root array shapes, but not for tuple-contained leaf arrays. This allowed an inconsistent state where:

• buffer sizing honored the custom bit width, while
• typed literal population assumed a dense native representation.

Security impact

This can lead to a heap out-of-bounds write during LiteralProto ingestion/materialization.

Proposed fix

PR: #40838

[Omar-Khaleel]

Proposed fix PR:

#40838