| --- |
| license: mit |
| tags: [security, poc, executorch] |
| --- |
| # Harmless PoC: ExecuTorch `Program::get_method_name` execution_plan vector length OOB |
| |
| `Program::num_methods` / `get_method_name` index `Program.execution_plan[plan_index]` using a forged FlatBuffer vector length with no bound against the program buffer. Under default `Program::Verification::Minimal`, loading a malicious `.pte` and calling `get_method_name(0)` triggers ASan heap-buffer-overflow READ at `program.cpp:361`. |
|
|
| Distinct from packaged Method::init values/chains/instructions/operators/delegates, READY `backend_delegate_data`, READY constant/mutable offsets, MethodMeta sizes, Vela, VGF, Vulkan. |
|
|
| ## Files |
| - `poc_execution_plan_asan.cpp`, `asan.log` |
| - `method_load_stub.cpp` (link stub for unused `Method::load`) |
| - `NOTES.md` |
|
|
| ```bash |
| ./poc_execution_plan_asan |
| ``` |
|
|
