metadata
license: mit
tags:
- security
- poc
- executorch
Harmless PoC: ExecuTorch MPS constant-segment heap OOB at load
MPSGraphBuilder::getConstantData trusts forged segment_offset / constant_buffer_size
with no check against MPSDelegateHeader.constant_data_size. Header Parse lacks XNN #18784 extent gates.
Pin: 8077bb60bd1eefed17006e7911b92d32041772b6
cd lab/runs/executorch_mps_blob && ./build_and_run.sh
Harmless crash PoC only. No ACE payload.