trevdatastreams/armnn-tflite-mean-missing-axis-oob-poc

Arm NN TFLite Mean missing-axis-input out-of-bounds read

This repository contains a minimal differential reproduction for a native heap-buffer-overflow read in Arm NN's TFLite MEAN parser.

Arm NN commit: 2b61cecc9df7a43fca1463795062cf359e6be820

Files

• control.tflite: verifier-valid MEAN model with its required input and axis tensor; parses successfully.
• trigger.tflite: verifier-valid MEAN operator with only the data input; AddressSanitizer reports a four-byte heap-buffer-overflow read during ParseMean.
• control.json and trigger.json: deterministic FlatBuffers sources.
• harness.cpp: minimal public-API loader.
• asan-output.txt: representative sanitizer report.
• armnn-tflite-mean-missing-axis-oob-poc.zip: complete source and fixtures.

Root cause

ParseMean() checks the output count but never validates that inputs contains the two entries the parser immediately requests:

auto inputs = GetInputs(m_Model, subgraphIndex, operatorIndex);
auto outputs = GetOutputs(m_Model, subgraphIndex, operatorIndex);
CHECK_VALID_SIZE(outputs.size(), 1);

TensorInfo inputTensorInfo = InputTensorInfo(subgraphIndex, operatorIndex, 0);
TensorInfo dimTensorInfo = InputTensorInfo(subgraphIndex, operatorIndex, 1);
...
BufferRawPtr axisBufferPtr = GetBuffer(m_Model, inputs[1]->buffer);

For a one-input operator, InputTensorInfo(..., 1) reads immediately past the four-byte operator.inputs vector.

Reproduction

Build the fixtures with Arm NN's pinned TFLite schema:

flatc -b schema.fbs control.json
flatc -b schema.fbs trigger.json

Build Arm NN's TFLite parser with ASan/UBSan, compile harness.cpp, then:

./harness control.tflite

ASAN_OPTIONS=abort_on_error=1:detect_leaks=0 \
UBSAN_OPTIONS=print_stacktrace=1:halt_on_error=1 \
./harness trigger.tflite

Expected trigger:

ERROR: AddressSanitizer: heap-buffer-overflow
READ of size 4
    #0 armnnTfLiteParser::TfLiteParserImpl::InputTensorInfo(...)
    #1 armnnTfLiteParser::TfLiteParserImpl::ParseMean(...)
0x... is located 0 bytes after 4-byte region [0x...,0x...)

Three interleaved controls exited 0. Three triggers exited 134 with the same sanitizer signature.

Fixture integrity

878159da3215004fa2637014ab771ed6da5f62104bb347e15ffce2575bba69c9  control.tflite
bb71a6fac73964af648219293e93e9a7586a1920a5b2cd4d9b35bfdb6f978750  trigger.tflite

Both files are 528 bytes.