metadata
license: mit
tags:
- security
- poc
- executorch
Harmless PoC: ExecuTorch nested TensorList/OptionalTensorList items length OOB
Method::parse_values → parseTensorList indexes TensorList.items[j] using a forged FlatBuffer vector length with no bound against the program buffer. Under default Program::Verification::Minimal, loading a malicious .pte and calling Method::load triggers ASan heap-buffer-overflow READ at tensor_parser_exec_aten.cpp:98 (via method.cpp:618).
Distinct from packaged IntList/BoolList/DoubleList items and top-level values/chains/instructions/operators/delegates/backend_delegate_data.
Files
poc_method_tensorlist_items_asan.cpp,asan.log(tensorlist-items-oob)- related:
optional-tensorlist-items-oob NOTES.md
./poc_method_tensorlist_items_asan tensorlist-items-oob