metadata
license: mit
tags:
- security
- poc
- executorch
Harmless PoC: ExecuTorch nested IntList/BoolList/DoubleList items length OOB
Method::parse_values indexes IntList.items[j] using a forged FlatBuffer vector length with no bound against the program buffer. Under default Program::Verification::Minimal, loading a malicious .pte and calling Method::load triggers ASan heap-buffer-overflow READ at method.cpp:523.
Distinct from packaged top-level values/chains/instructions/operators/delegates/backend_delegate_data and READY constant/mutable offset series.
Files
poc_method_list_items_asan.cpp,asan.log(intlist-items-oob)- related:
boollist-items-oob,doublelist-items-oob NOTES.md
./poc_method_list_items_asan intlist-items-oob