[GPU] Use src buffer size for copy_to() call when called for two cldnn::memory objects

src/plugins/intel_gpu/include/intel_gpu/runtime/memory.hpp

@@ -110,7 +110,7 @@ struct memory {
 
     virtual event::ptr copy_to(stream& stream, memory& other, bool blocking = true) const {
         const auto zero_offset = 0;
-        const auto data_size = other._bytes_count;
+        const auto data_size = _bytes_count;
         return copy_to(stream, other, zero_offset, zero_offset, data_size, blocking);
     }
 

src/plugins/intel_gpu/src/runtime/ocl/ocl_memory.cpp

@@ -27,6 +27,30 @@
 namespace cldnn {
 namespace ocl {
 
+static inline void check_boundaries(const std::string& func_str,
+                                    size_t src_size,
+                                    size_t src_offset,
+                                    size_t dst_size,
+                                    size_t dst_offset,
+                                    size_t copy_size) {
+    OPENVINO_ASSERT(src_offset + copy_size <= src_size && dst_offset + copy_size <= dst_size,
+                    "[GPU] Incorrect buffer sizes for ",
+                    func_str,
+                    " call. ",
+                    "Parameters provided are",
+                    ": src_size=",
+                    src_size,
+                    ", src_offset=",
+                    src_offset,
+                    ", dst_size=",
+                    dst_size,
+                    ", dst_offset=",
+                    dst_offset,
+                    ", copy_size=",
+                    copy_size,
+                    ".");
+}
+
 static inline cldnn::event::ptr create_event(stream& stream, size_t bytes_count, bool need_user_event) {
     if (bytes_count == 0) {
         GPU_DEBUG_TRACE_DETAIL << "Skip memory operation for 0 size tensor" << std::endl;
@@ -132,6 +156,8 @@ event::ptr gpu_buffer::copy_from(stream& stream, const void* data_ptr, size_t sr
     if (size == 0)
         return result_event;
 
+    check_boundaries("gpu_buffer::copy_from(void*)", SIZE_MAX, src_offset, _bytes_count, dst_offset, size);
+
     auto cl_stream = downcast<ocl_stream>(&stream);
     auto cl_event = blocking ? nullptr : &downcast<ocl_event>(result_event.get())->get();
     auto src_ptr = reinterpret_cast<const char*>(data_ptr) + src_offset;
@@ -146,6 +172,8 @@ event::ptr gpu_buffer::copy_from(stream& stream, const memory& src_mem, size_t s
     if (size == 0)
         return result_event;
 
+    check_boundaries("gpu_buffer::copy_from(memory&)", src_mem.size(), src_offset, _bytes_count, dst_offset, size);
+
     switch (src_mem.get_allocation_type()) {
         case allocation_type::usm_host:
         case allocation_type::usm_shared:
@@ -180,6 +208,8 @@ event::ptr gpu_buffer::copy_to(stream& stream, void* data_ptr, size_t src_offset
     if (size == 0)
         return result_event;
 
+    check_boundaries("gpu_buffer::copy_to(void*)", _bytes_count, src_offset, SIZE_MAX, dst_offset, size);
+
     auto cl_stream = downcast<ocl_stream>(&stream);
     auto cl_event = blocking ? nullptr : &downcast<ocl_event>(result_event.get())->get();
     auto dst_ptr = reinterpret_cast<char*>(data_ptr) + dst_offset;
@@ -540,6 +570,8 @@ event::ptr gpu_usm::copy_from(stream& stream, const void* data_ptr, size_t src_o
     if (size == 0)
         return result_event;
 
+    check_boundaries("gpu_usm::copy_from(void*)", SIZE_MAX, src_offset, _bytes_count, dst_offset, size);
+
     auto cl_stream = downcast<ocl_stream>(&stream);
     auto cl_event = blocking ? nullptr : &downcast<ocl_event>(result_event.get())->get();
     auto src_ptr = reinterpret_cast<const char*>(data_ptr) + src_offset;
@@ -555,6 +587,8 @@ event::ptr gpu_usm::copy_from(stream& stream, const memory& src_mem, size_t src_
     if (size == 0)
         return result_event;
 
+    check_boundaries("gpu_usm::copy_from(memory&)", src_mem.size(), src_offset, _bytes_count, dst_offset, size);
+
     auto cl_stream = downcast<ocl_stream>(&stream);
     auto cl_event = blocking ? nullptr : &downcast<ocl_event>(result_event.get())->get();
 
@@ -586,6 +620,8 @@ event::ptr gpu_usm::copy_to(stream& stream, void* data_ptr, size_t src_offset, s
     if (size == 0)
         return result_event;
 
+    check_boundaries("gpu_usm::copy_to(void*)", _bytes_count, src_offset, SIZE_MAX, dst_offset, size);
+
     auto cl_stream = downcast<ocl_stream>(&stream);
     auto cl_event = blocking ? nullptr : &downcast<ocl_event>(result_event.get())->get();
     auto src_ptr = reinterpret_cast<const char*>(buffer_ptr()) + src_offset;

src/plugins/intel_gpu/tests/unit/module_tests/usm_memory_test.cpp

@@ -488,3 +488,15 @@ INSTANTIATE_TEST_SUITE_P(mem_test,
                                                               mem_test_params{0, 79, 381},
                                                               mem_test_params{100, 79, 381}),
                                             ::testing::Values(false, true)));
+
+TEST(mem_test, copy_small_buf_to_large_with_out_of_bound_access) {
+    auto& ocl_engine = dynamic_cast<ocl::ocl_engine&>(get_test_engine());
+    auto& stream = get_test_stream();
+    auto small_buffer_size = 2048;
+    auto large_buffer_size = 3072;
+
+    auto small_buffer = ocl_engine.allocate_memory({{small_buffer_size}, data_types::u8, format::bfyx}, allocation_type::cl_mem, false);
+    auto large_buffer = ocl_engine.allocate_memory({{large_buffer_size}, data_types::u8, format::bfyx}, allocation_type::cl_mem, false);
+
+    OV_ASSERT_NO_THROW(small_buffer->copy_to(stream, *large_buffer, true));
+}