File size: 2,320 Bytes
d571ec4 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 | [poc] wrote poc/evil_nullderef.ptd (256 bytes)
[poc] calling get_tensor_layout("w") ...
AddressSanitizer:DEADLYSIGNAL
=================================================================
==4761==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000004 (pc 0x000100d1e530 bp 0x00016f106150 sp 0x00016f105e40 T0)
==4761==The signal is caused by a READ memory access.
==4761==Hint: address points to the zero page.
#0 0x000100d1e530 in executorch::runtime::TensorLayout::create(executorch::runtime::Span<int const>, executorch::runtime::Span<unsigned char const>, executorch::runtime::etensor::ScalarType) tensor_layout.cpp:59
#1 0x000100d132cc in executorch::extension::(anonymous namespace)::create_tensor_layout(flat_tensor_flatbuffer::TensorLayout const*) flat_tensor_data_map.cpp:121
#2 0x000100d12260 in executorch::extension::FlatTensorDataMap::get_tensor_layout(std::__1::basic_string_view<char, std::__1::char_traits<char>>) const flat_tensor_data_map.cpp:143
#3 0x000100cf9530 in main craft_and_load_ptd.cpp:95
#4 0x00018855dd50 in start+0x1c0c (dyld:arm64e+0x8d50)
==4761==Register values:
x[0] = 0x000000016f105e60 x[1] = 0x0000000000000000 x[2] = 0x0000000000000000 x[3] = 0x000000016f105e30
x[4] = 0x000000016f105e40 x[5] = 0x000000016f106460 x[6] = 0x0000000000000004 x[7] = 0x0000000000000001
x[8] = 0x0000000000000004 x[9] = 0x0000000000000004 x[10] = 0x000000702de40bc5 x[11] = 0x000000002de20bc5
x[12] = 0x000000002de20bc5 x[13] = 0x0000000000000000 x[14] = 0x0000000000000000 x[15] = 0x000060f0000000e0
x[16] = 0x0000000100d1f358 x[17] = 0x0000000101514548 x[18] = 0x0000000000000000 x[19] = 0x000000016f105f80
x[20] = 0x00000001f4ba1248 x[21] = 0x00000001f48f4e10 x[22] = 0xfffffffffffffff0 x[23] = 0x00000001f4ba4960
x[24] = 0x0000000000000001 x[25] = 0x000000016f106ce0 x[26] = 0x00000001f4ba4970 x[27] = 0x0000000000000000
x[28] = 0x0000000000000000 fp = 0x000000016f106150 lr = 0x0000000100d1e4d4 sp = 0x000000016f105e40
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV tensor_layout.cpp:59 in executorch::runtime::TensorLayout::create(executorch::runtime::Span<int const>, executorch::runtime::Span<unsigned char const>, executorch::runtime::etensor::ScalarType)
==4761==ABORTING
|