CVE-2022-23574: Out of bounds read and write in Tensorflow

There is a typo in TensorFlow’s SpecializeType which results in heap OOB read/write:

for (int i = 0; i < op_def.output_arg_size(); i++) {
// ...
for (int j = 0; j < t->args_size(); j++) {
auto* arg = t->mutable_args(i);
// ...
}
}

Due to a typo, arg is initialized to the ith mutable argument in a loop where the loop index is j. Hence it is possible to assign to arg from outside the vector of arguments. Since this is a mutable proto value, it allows both read and write to outside of bounds data.