[poc] wrote poc/evil_nullderef.ptd (256 bytes) [poc] calling get_tensor_layout("w") ... AddressSanitizer:DEADLYSIGNAL ================================================================= ==4761==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000004 (pc 0x000100d1e530 bp 0x00016f106150 sp 0x00016f105e40 T0) ==4761==The signal is caused by a READ memory access. ==4761==Hint: address points to the zero page. #0 0x000100d1e530 in executorch::runtime::TensorLayout::create(executorch::runtime::Span, executorch::runtime::Span, executorch::runtime::etensor::ScalarType) tensor_layout.cpp:59 #1 0x000100d132cc in executorch::extension::(anonymous namespace)::create_tensor_layout(flat_tensor_flatbuffer::TensorLayout const*) flat_tensor_data_map.cpp:121 #2 0x000100d12260 in executorch::extension::FlatTensorDataMap::get_tensor_layout(std::__1::basic_string_view>) const flat_tensor_data_map.cpp:143 #3 0x000100cf9530 in main craft_and_load_ptd.cpp:95 #4 0x00018855dd50 in start+0x1c0c (dyld:arm64e+0x8d50) ==4761==Register values: x[0] = 0x000000016f105e60 x[1] = 0x0000000000000000 x[2] = 0x0000000000000000 x[3] = 0x000000016f105e30 x[4] = 0x000000016f105e40 x[5] = 0x000000016f106460 x[6] = 0x0000000000000004 x[7] = 0x0000000000000001 x[8] = 0x0000000000000004 x[9] = 0x0000000000000004 x[10] = 0x000000702de40bc5 x[11] = 0x000000002de20bc5 x[12] = 0x000000002de20bc5 x[13] = 0x0000000000000000 x[14] = 0x0000000000000000 x[15] = 0x000060f0000000e0 x[16] = 0x0000000100d1f358 x[17] = 0x0000000101514548 x[18] = 0x0000000000000000 x[19] = 0x000000016f105f80 x[20] = 0x00000001f4ba1248 x[21] = 0x00000001f48f4e10 x[22] = 0xfffffffffffffff0 x[23] = 0x00000001f4ba4960 x[24] = 0x0000000000000001 x[25] = 0x000000016f106ce0 x[26] = 0x00000001f4ba4970 x[27] = 0x0000000000000000 x[28] = 0x0000000000000000 fp = 0x000000016f106150 lr = 0x0000000100d1e4d4 sp = 0x000000016f105e40 AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV tensor_layout.cpp:59 in executorch::runtime::TensorLayout::create(executorch::runtime::Span, executorch::runtime::Span, executorch::runtime::etensor::ScalarType) ==4761==ABORTING