metadata
license: mit
tags:
- security
- poc
- executorch
Harmless PoC: ExecuTorch MPS mps_values Get(input_ids) heap OOB
compileMPSGraph trusts forged input_ids with no id < mps_values()->size() before Get(id).
Distinct from packaged constant-segment getConstantData / segment_offset bug.
Pin: 8077bb60bd1eefed17006e7911b92d32041772b6
cd lab/runs/executorch_mps_values_index && ./build_and_run.sh
Harmless crash PoC only. No ACE payload.