If resulting dimensions overflow an int32, we were seeing an overflow and
crash due to size mismatch during broadcast assignment.  The cause is a simple
dimension type mismatch.

Note that actual tests for this are currently impractical, since successful
operations require more than 2^32 elements and OOM on most machines.

PiperOrigin-RevId: 479336566

r2.10 cherry-pick: 1be74370 "Resolve a sanitizer issue with invalid char -> bool conversion."

r2.10 cherry-pick: a65411a1 "Fix OOB write in grappler."

Discovered via internal fuzzing.

PiperOrigin-RevId: 482097391

When printing a tensor, we get it's data as a `const char*` array (since that's the underlying storage) and then we typecast it to the element type. However, conversions from `char` to `bool` are undefined if the `char` is not `0` or `1`, so sanitizers/fuzzers will crash.

To fix, we're creating a mutable `char` array to convert the chars to 0/1, according to bool rules.

Discovered via internal fuzzing.

PiperOrigin-RevId: 482297563

r2.10 cherry-pick: 717ca98d "Adding missing requirement on inputs for MirrorPadGrad op and updating arithmetic to account for int32 padding values."

Adding missing requirement on inputs for MirrorPadGrad op and updating arithmetic to account for int32 padding values.

PiperOrigin-RevId: 480691952

Cherry-pick Tensor.numpy() segfault fixes on 2.10

Merge pull request #58056 from vinila21/cherrypick-f5381e0e-on-r2.10

Fix OOB error when op input sizes do not match.

Merge pull request #58060 from vinila21/cherrypick-b389f5c9-on-r2.10

Add true_classes input validation for candidate sampler ops.

The values must be within the valid range of the sampler.  Added a
check for this.

PiperOrigin-RevId: 479441496

In cases where op input sizes are specified as in
```
REGISTER_OP("DynamicStitch")
    .Input("indices: N * int32")
    .Input("data: N * T")
    .Output("merged: T")
    .Attr("N : int >= 1")
    .Attr("T : type")
    .SetShapeFn(DynamicStitchShapeFunction);
```
if differing number of inputs are provided (e.g. 3 for `indices` and 4 for `data`)
we can get a crash in the executor when parsing the inputs, even before the kernel
called.  Here we avoid this by checking the return code for the argument id and
exit early.

PiperOrigin-RevId: 478068540

Merge pull request #58015 from tensorflow/cherrypick-c676a2d7-on-r2.10

Add a check that strided slice op strides argument has reasonable size

PiperOrigin-RevId: 478036251

Merge pull request #57952 from tensorflow/cherrypick-1ecf591f-on-r2.10

Fix std::bad_alloc exception (followed by crash) when loading a SavedModel containing a tensor of unknown rank.

If a numpy array is created with a shape such that one element is zero and the others sum to a large number, an error will be raised. E.g. the following raises an error:

np.ones((0, 2**31, 2**31))

TF previously would not check the return value of PyArray_SimpleNewFromData, which returns null on such shapes. Now the return value is checked.

PiperOrigin-RevId: 477751929

Numpy arrays can have at most 32 dimensions. When a tensor is converted to a Numpy array, PyArray_SimpleNewFromData is called, which returns nullptr if given more than 32 dimensions. Before, TF would dereference this nullptr. This change adds a check for the number of dimensions, and raises a proper error instead if there are more than 32 dimensions.

PiperOrigin-RevId: 469580660

Note: This fix will have to be cherry picked in r2.10, r2.9, and r2.8.
PiperOrigin-RevId: 479125772

Note: This fix will have to be cherry picked in r2.10, r2.9, and r2.8.
PiperOrigin-RevId: 479141644

Merge pull request #57974 from nitins17/cherrypick-72210c84-on-r2.10

Use setup.py for building the installer wheels for collaborator builds

PiperOrigin-RevId: 478593715

Fix std::bad_alloc exception (followed by crash) when loading a SavedModel containing a tensor of unknown rank.

PiperOrigin-RevId: 475317100

Merge pull request #57811 from tensorflow/cherrypick-02400ea2-on-r2.10

Fix tf.math.sobol_sample vulnerability with non-scalar inputs.

Check that the element_shape input is valid.
Add graph/eager unit tests.

Note: This fix will have to be cherry picked in r2.10, r2.9, and r2.8.
PiperOrigin-RevId: 477544091

Check that the size input is valid.
Add graph/eager unit tests. Graph mode was already ok but eager mode was not.

Note: This fix will have to be cherry picked in r2.10, r2.9, and r2.8.
PiperOrigin-RevId: 477002316

Check that the num_elements input is valid.
Add graph/eager unit tests. Graph mode was already ok but eager mode was not.

Note: This fix will have to be cherry picked in r2.10, r2.9, and r2.8.
PiperOrigin-RevId: 477225661

Check that the size input is valid.
Add graph/eager unit tests. Graph mode was already ok but eager mode was not.

Note: This fix will have to be cherry picked in r2.10, r2.9, and r2.8.
PiperOrigin-RevId: 477002316
Co-authored-by: NAlan Liu <liualan@google.com>

If a list of quantized tensors is assigned to an attribute, the pywrap code was failing to
parse the tensor and returning a `nullptr`, which wasn't caught.  Here we check the return
value and set an appropriate error status.

PiperOrigin-RevId: 476981029
Co-authored-by: NAntonio Sanchez <cantonios@google.com>

Check that given inputs are valid.
Add graph/eager unit tests. Graph mode was already ok but eager mode was not.

PiperOrigin-RevId: 476117492

Update estimator and keras version in TF 2.10 branch for 2.10.0.

Update version numbers for TensorFlow 2.10.0

Update release notes with security updates

Update release notes with security updates

r2.10 cherry-pick: b5f6fbfb "Re-enable testTensorListReserveWithNonScalarNumElements to work with mlir as well."

PiperOrigin-RevId: 466460987

Revert "r2.10 cherry-pick: e9863e9a "Fix tf.raw_ops.EmptyTensorList vulnerability from non scalar `num_elements`.""

Revert "r2.10 cherry-pick: e9863e9a "Fix tf.raw_ops.EmptyTensorList vulnerability from non scalar `num_elements`.""

r2.10 cherry-pick: b306fb31 "Apply `PyArray_Check` in `FillStringBufferWithPyArray` to avoid a hard crash when user pass in a TF eager tensor as input."