README.md

# executorch FlatTensorDataMap .ptd null-pointer dereference (CWE-476)

Null-pointer dereference in the ExecuTorch `.ptd` (FlatTensor named-data map)
loader. A crafted `.ptd` whose `TensorLayout` omits the non-required flatbuffer
fields `sizes` and/or `dim_order` drives `create_tensor_layout()` to dereference
a `nullptr` accessor result, crashing any process that loads the file.

- Target: `pytorch/executorch`
- Commit: `9b7fd14a91fb5222f6da83be7dcdb72af2710530`
- Vulnerable file: `extension/flat_tensor/flat_tensor_data_map.cpp`
- Vulnerable function: `create_tensor_layout()` (lines 114-125)
- Reached via public API: `FlatTensorDataMap::get_tensor_layout()` (line 143)
- Schema: `extension/flat_tensor/serialize/flat_tensor.fbs`

## Files

- `poc_flat_tensor.cpp` - harness. Builds a malicious `.ptd` (FlatTensor with
  a `NamedData` whose `TensorLayout` omits `sizes` or `dim_order`), then drives
  the REAL `FlatTensorDataMap::load()` + `get_tensor_layout("weight")`.
- `malicious_sizes.ptd` - crafted `.ptd` with `TensorLayout.sizes` omitted.
  Crashes at `flat_tensor_data_map.cpp:118` (`sizes()->size()`).
- `malicious_dimorder.ptd` - crafted `.ptd` with `TensorLayout.dim_order`
  omitted. Crashes at line 124 (null `dim_order` Span consumed by
  `TensorLayout::create`).
- `asan_sizes.txt`, `asan_dimorder.txt` - captured ASan SEGV output.

## Build

Against a standard ExecuTorch ASan build
(`-DEXECUTORCH_BUILD_EXTENSION_FLAT_TENSOR=ON`,
`CMAKE_CXX_FLAGS="-fsanitize=address -g -O0 -fno-omit-frame-pointer"`):

```
clang++ -g -O0 -fsanitize=address -fno-omit-frame-pointer -std=c++17 \
  -I<build>/extension/flat_tensor/include -I<build>/include \
  -I<src>/.. -I<src>/runtime/core/portable_type/c10 \
  -I<src>/third-party/flatbuffers/include \
  poc_flat_tensor.cpp \
  <build>/extension/flat_tensor/libextension_flat_tensor.a \
  <build>/extension/data_loader/libextension_data_loader.a \
  <build>/libexecutorch_core.a <build>/libexecutorch.a \
  -o poc
```

## Run

```
./poc malicious_sizes.ptd sizes        # omit sizes -> SEGV at line 118
./poc malicious_dimorder.ptd dim_order # omit dim_order -> SEGV at line 124
```

The malicious `.ptd` files are also provided pre-built and can be loaded by any
application that consumes untrusted `.ptd` external-data files via
`FlatTensorDataMap`.

## Root cause

`extension/flat_tensor/serialize/flat_tensor.fbs`:

```
table TensorLayout {
  scalar_type: executorch_flatbuffer.ScalarType;
  sizes: [int32];      // NON-required (optional)
  dim_order: [uint8];  // NON-required (optional)
}
```

`sizes` and `dim_order` are optional, so the FlatBuffers accessors
`tensor_layout->sizes()` and `tensor_layout->dim_order()` return `nullptr` when
the fields are omitted. `create_tensor_layout()` dereferences them with no null
check.

This is a research PoC for the huntr Model File Vulnerability program. All
testing was performed locally.