You need to agree to share your contact information to access this model

This repository is publicly accessible, but you have to accept the conditions to access its files and content.

Harmless PoC: OpenVINO IR string Const shape > strings_count OOB

IR deserialization of element::string Constants does not require XML shape to equal packed strings_count. Post-load walks using shape_size(m_shape) (e.g. Constant::get_value_strings / evaluate) read past the buffer.

Distinct from IR offset/shape integer overflows, ONNX ORT_MEM_ADDR, and NPU metadata OOB.

Files

shape_gt_count.xml / shape_gt_count.bin
poc_shape_count_mismatch_asan.cpp, asan.log
repro_shape_gt_count.py, NOTES.md

Downloads last month: -; Downloads are not tracked for this model. How to track

Inference Providers NEW

This model isn't deployed by any Inference Provider. 🙋 Ask for provider support