Add README.md

ec08874 verified 18 days ago

933 Bytes

license: mit
tags:
  - security
  - poc
  - executorch

Harmless PoC: ExecuTorch MethodMeta memory_planned_buffers vector length OOB

MethodMeta::num_memory_planned_buffers / memory_planned_buffer_size index ExecutionPlan.non_const_buffer_sizes[index+1] using a forged FlatBuffer vector length with no bound against the program buffer. Under default Program::Verification::Minimal, loading a malicious .pte and calling memory_planned_buffer_size(0) triggers ASan heap-buffer-overflow READ at method_meta.cpp:357.

Distinct from submitted MethodMeta Tensor.sizes, packaged MethodMeta I/O index (inputs/outputs), Program execution_plan / backend_delegate_data, and Method::init values/operators/delegates/list-items.

Files

poc_method_meta_memory_planned_asan.cpp, asan.log
method_load_stub.cpp (link stub for unused Method::load)
NOTES.md

./poc_method_meta_memory_planned_asan