README.md

metadata

license: mit
tags:
  - security
  - poc
  - executorch

Harmless PoC: ExecuTorch Program::get_method_name execution_plan vector length OOB

Program::num_methods / get_method_name index Program.execution_plan[plan_index] using a forged FlatBuffer vector length with no bound against the program buffer. Under default Program::Verification::Minimal, loading a malicious .pte and calling get_method_name(0) triggers ASan heap-buffer-overflow READ at program.cpp:361.

Distinct from packaged Method::init values/chains/instructions/operators/delegates, READY backend_delegate_data, READY constant/mutable offsets, MethodMeta sizes, Vela, VGF, Vulkan.

Files

• poc_execution_plan_asan.cpp, asan.log
• method_load_stub.cpp (link stub for unused Method::load)
• NOTES.md

./poc_execution_plan_asan