| license: mit | |
| tags: [security, poc, executorch] | |
| # Harmless PoC: ExecuTorch MPS mps_values Get(input_ids) heap OOB | |
| `compileMPSGraph` trusts forged `input_ids` with no `id < mps_values()->size()` before `Get(id)`. | |
| Distinct from packaged constant-segment `getConstantData` / `segment_offset` bug. | |
| Pin: `8077bb60bd1eefed17006e7911b92d32041772b6` | |
| ```bash | |
| cd lab/runs/executorch_mps_values_index && ./build_and_run.sh | |
| ``` | |
| Harmless crash PoC only. No ACE payload. | |