| --- |
| license: mit |
| tags: [security, poc, executorch] |
| --- |
| # Harmless PoC: ExecuTorch `get_constant_buffer_data` offsets OOB |
| |
| `Program::get_constant_buffer_data` indexes `constant_segment.offsets[i]` using a forged FlatBuffer vector length with no bound against the program buffer. Under default `Program::Verification::Minimal`, loading a malicious `.pte` and requesting a high buffer index triggers ASan heap-buffer-overflow READ at `program.cpp:453`. |
| |
| Distinct from MethodMeta sizes OOB, WebGPUDelegateHeader, and PTE segment integer-overflow hardening (#18662/#19268). |
| |
| ## Files |
| - `poc_constant_buffer_asan.cpp`, `asan.log` (offsets-oob) |
| - `NOTES.md` |
|
|
| ```bash |
| ./poc_constant_buffer_asan offsets-oob |
| ``` |
|
|
