From dc8c4ee05a55d7978a4e12fa6a766f993a87921d Mon Sep 17 00:00:00 2001
From: Arseniy Obolenskiy <arseniy.obolenskiy@intel.com>
Date: Fri, 3 Jan 2025 16:59:20 +0100
Subject: [PATCH] Fix integer overflow coverity issues in CPU plugin: 1548297,
 1548502, 1548522 (#28261)

### Details:
- This PR fixes coverity issue with CID 1548297, 1548502, 1548522
(overflowed constant)

### Tickets:
 - [CVS-145092](https://jira.devtools.intel.com/browse/CVS-145092)
---
 src/plugins/intel_cpu/src/nodes/adaptive_pooling.cpp | 2 +-
 src/plugins/intel_cpu/src/nodes/batch_to_space.cpp   | 1 +
 src/plugins/intel_cpu/src/nodes/subgraph.cpp         | 8 +++++---
 src/plugins/intel_cpu/src/nodes/subgraph.h           | 2 +-
 4 files changed, 8 insertions(+), 5 deletions(-)

diff --git a/src/plugins/intel_cpu/src/nodes/adaptive_pooling.cpp b/src/plugins/intel_cpu/src/nodes/adaptive_pooling.cpp
index f4af11b0f2362a..c0627ff43bf6ba 100644
--- a/src/plugins/intel_cpu/src/nodes/adaptive_pooling.cpp
+++ b/src/plugins/intel_cpu/src/nodes/adaptive_pooling.cpp
@@ -191,7 +191,7 @@ void AdaptivePooling::execute(dnnl::stream strm) {
     auto dstStrides = getChildEdgeAt(0)->getMemory().getDescWithType<BlockedMemoryDesc>()->getStrides();
 
     // unified strides array
-    const size_t tailDimsOffset = (isTailCFmt ? -1 : 0);
+    const ptrdiff_t tailDimsOffset = (isTailCFmt ? -1 : 0);
     const size_t inStrides[5] = {srcStrides[0],
                                  (isTailCFmt ? 1 : srcStrides[1]),
                                  (spatialDimsCount == 3 ? srcStrides[2 + tailDimsOffset] : 0),
diff --git a/src/plugins/intel_cpu/src/nodes/batch_to_space.cpp b/src/plugins/intel_cpu/src/nodes/batch_to_space.cpp
index 50665c083ec930..098e93eeb19a60 100644
--- a/src/plugins/intel_cpu/src/nodes/batch_to_space.cpp
+++ b/src/plugins/intel_cpu/src/nodes/batch_to_space.cpp
@@ -156,6 +156,7 @@ void BatchToSpace::batchToSpaceKernel() {
     size_t channels = (inShape5D[1] / blockSize);
     channels = channels == 0 ? 1 : channels;
     const size_t workAmount = inShape5D[0] * channels;
+    OPENVINO_ASSERT(workAmount > 0, errorPrefix, " has unsupported work amount == 0");
 
     parallel_nt(0, [&](const int ithr, const int nthr) {
         size_t start(0lu), end(0lu);
diff --git a/src/plugins/intel_cpu/src/nodes/subgraph.cpp b/src/plugins/intel_cpu/src/nodes/subgraph.cpp
index 2b0c7b55fb043d..ba6f1eda215dce 100644
--- a/src/plugins/intel_cpu/src/nodes/subgraph.cpp
+++ b/src/plugins/intel_cpu/src/nodes/subgraph.cpp
@@ -236,7 +236,7 @@ struct SubgraphCodeGeneratorKey {
     bool operator==(const SubgraphCodeGeneratorKey& rhs) const;
 
     std::shared_ptr<Subgraph::SubgraphAttrs> attrs = nullptr;
-    uint8_t broadcasting_mask = 0;
+    uint32_t broadcasting_mask = 0;
 };
 
 struct SubgraphShapeInferResultKey {
@@ -738,8 +738,10 @@ Subgraph::ControlFlowPasses Subgraph::getControlFlowPasses() const {
     return backend_passes;
 }
 
-uint8_t Subgraph::getBroadcastingMask(const std::vector<VectorDims>& input_shapes) {
-    uint8_t mask = 0;
+uint32_t Subgraph::getBroadcastingMask(const std::vector<VectorDims>& input_shapes) {
+    uint32_t mask = 0;
+    OPENVINO_ASSERT(broadcastable_inputs.size() <= sizeof(mask) * CHAR_BIT,
+                    "Incorrect size of broadcastable inputs of Subgraph");
     for (const auto& broadcastable_input : broadcastable_inputs) {
         const auto& shape = input_shapes[broadcastable_input.first];
         mask = mask << 1;
diff --git a/src/plugins/intel_cpu/src/nodes/subgraph.h b/src/plugins/intel_cpu/src/nodes/subgraph.h
index aac0fa1ea2f535..a84e46d9ae02da 100644
--- a/src/plugins/intel_cpu/src/nodes/subgraph.h
+++ b/src/plugins/intel_cpu/src/nodes/subgraph.h
@@ -70,7 +70,7 @@ class Subgraph : public Node {
     std::pair<std::vector<ov::element::Type>, std::vector<ov::element::Type>> getIOPrecisions() const;
 
     static uint64_t getBodyHash(const std::shared_ptr<snippets::op::Subgraph>& snippet);
-    uint8_t getBroadcastingMask(const std::vector<VectorDims>& input_shapes);
+    uint32_t getBroadcastingMask(const std::vector<VectorDims>& input_shapes);
 
     using DataFlowPasses = std::vector<ov::snippets::pass::Manager::PositionedPassBase>;
     using ControlFlowPasses = std::vector<ov::snippets::lowered::pass::PassPipeline::PositionedPassLowered>;