| license: mit | |
| tags: [security, poc, executorch] | |
| # Harmless PoC: ExecuTorch MPS constant-segment heap OOB at load | |
| `MPSGraphBuilder::getConstantData` trusts forged `segment_offset` / `constant_buffer_size` | |
| with no check against `MPSDelegateHeader.constant_data_size`. Header Parse lacks XNN #18784 extent gates. | |
| Pin: `8077bb60bd1eefed17006e7911b92d32041772b6` | |
| ```bash | |
| cd lab/runs/executorch_mps_blob && ./build_and_run.sh | |
| ``` | |
| Harmless crash PoC only. No ACE payload. | |