[MXNET-969] Fix buffer overflow in RNNOp

Co-authored-by: Sina Md <[email protected]>

src/operator/rnn-inl.h

@@ -552,6 +552,13 @@ class RNNOp : public Operator{
     }
 
     DType* reserve_space_ptr = static_cast<DType*>(reserve_space_.dptr);
+
+    int req_statecell = 0;
+    if (param_.mode == rnn_enum::kLstm) {
+      // State cell should be present for LSTMs.
+      req_statecell = req[rnn_enum::kStateCell];
+    }
+
     RNNBackward<DType>(workspace.dptr_,
                        reserve_space_ptr,
                        param_.num_layers,
@@ -576,7 +583,7 @@ class RNNOp : public Operator{
                        req[rnn_enum::kData],
                        req[rnn_enum::kParams],
                        req[rnn_enum::kState],
-                       req[rnn_enum::kStateCell],
+                       req_statecell,
                        param_.p,
                        param_.mode);
   }