Hugging Face's logo

luckilytsh
/
executorch-methodmeta-sizes-oob-poc

ExecuTorch
security
poc
Model card Files
xet
 Community
executorch-methodmeta-sizes-oob-poc / README.md
luckilytsh's picture
luckilytsh
Add README.md
fb98b81 verified
preview code
|
Raw
History Blame Contribute Delete
836 Bytes
metadata 
license: mit
tags:
  - security
  - poc
  - executorch

Harmless PoC: ExecuTorch MethodMeta calculate_nbytes sizes OOB

MethodMeta::input_tensor_meta → TensorInfo::create → calculate_nbytes iterates sizes[i] using a forged FlatBuffer vector length with no bound against the program buffer. Under default Program::Verification::Minimal (or Release with ET_ENABLE_PROGRAM_VERIFICATION=0), querying MethodMeta triggers ASan heap-buffer-overflow READ at method_meta.cpp:63.

Distinct from WebGPUDelegateHeader and PTE segment hardening (#16704/#18662/#19268/#19904).

Files

  • poc_method_meta_asan.cpp, asan.log (sizes-oob)
  • asan_null_delegates.log, asan_null_values.log (related MethodMeta NPDs)
  • NOTES.md
# Build against executorch @ 8077bb60; see NOTES.md
./poc_method_meta_asan sizes-oob