Fix out-of-bounds write in SetStringData for rank-2 string inputs

[varun3257]

TfLiteInterpreterWrapper::SetStringData packs the serving input into TFLite's dynamic string format, whose header is a 4-byte string count followed by one 4-byte offset per string. The header and the stored count were sized from batch_size, which TfLiteSession::Run derives from the leading dimension (dim_size(0)) of the input, while the offset loop writes one entry for every string element (flat.size()). For an input of rank > 1 the element count exceeds the leading dimension, so a string tensor of shape [1, N] leaves batch_size at 1 while N+1 offsets are written into space allocated for 3 int32s, a heap out-of-bounds write. It is reachable over the Predict API (gRPC and REST) whenever a TFLite model with a string input is served, since the request controls the tensor rank and shape.

The fix counts the string elements actually written and uses that for the stored count, the allocation size, and the offset-table bound, so all three agree. The common rank-1 case, where the element count already equals the leading dimension, is unaffected.

Verified with an AddressSanitizer reproducer of the buffer math (12-byte allocation, 33 offsets written for a [1, 32] input) and a regression test in tflite_interpreter_pool_test.cc that feeds a rank-2 string input and checks the stored string count equals the element count.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.