| --- |
| license: mit |
| tags: [security, poc, executorch] |
| --- |
| # Harmless PoC: ExecuTorch MethodMeta non_const_buffer_device vector length OOB |
| |
| `MethodMeta::memory_planned_buffer_device` loops `ExecutionPlan.non_const_buffer_device` using a forged FlatBuffer vector length with no bound against the program buffer. Under default `Program::Verification::Minimal`, loading a malicious `.pte` and calling `memory_planned_buffer_device(0)` triggers ASan heap-buffer-overflow READ at `method_meta.cpp:391`. |
| |
| Distinct from packaged MethodMeta `non_const_buffer_sizes` / `memory_planned_buffer_size`, I/O index, Tensor.sizes, Program execution_plan/backend_delegate_data, Method::init vectors. |
|
|
| ## Files |
| - `poc_method_meta_buffer_device_asan.cpp`, `asan.log` |
| - `method_load_stub.cpp` (link stub for unused `Method::load`) |
| - `NOTES.md` |
|
|
| ```bash |
| ./poc_method_meta_buffer_device_asan |
| ``` |
|
|
