trevdatastreams/armnn-tflite-pad-missing-padding-oob-poc

Arm NN TFLite PAD missing-padding-input out-of-bounds read

This repository contains a minimal differential reproduction for a native heap-buffer-overflow read in Arm NN's TFLite PAD parser.

Arm NN commit: 2b61cecc9df7a43fca1463795062cf359e6be820

Files

• control.tflite: verifier-valid PAD model with its required data and paddings inputs; parses successfully.
• trigger.tflite: verifier-valid PAD operator with only the data input; AddressSanitizer reports a four-byte heap-buffer-overflow read during ParsePad.
• control.json and trigger.json: deterministic FlatBuffers sources.
• harness.cpp: minimal public-API loader.
• asan-output.txt: representative sanitizer report.
• armnn-tflite-pad-missing-padding-oob-poc.zip: complete source and fixtures.

Root cause

ParsePad() reads input index 1 before reaching either operator-specific input-count check:

auto inputs = GetInputs(m_Model, subgraphIndex, operatorIndex);
...
TensorInfo inputTensorInfo = InputTensorInfo(subgraphIndex, operatorIndex, 0);
TensorInfo padTensorInfo = InputTensorInfo(subgraphIndex, operatorIndex, 1);
std::vector<unsigned int> padBuffer =
    GetUIntBuffer(padTensorInfo, m_Model, inputs[1]->buffer);
...
if (opcode == tflite::BuiltinOperator_PAD)
{
    CHECK_VALID_SIZE(inputs.size(), 2);

For a one-input operator, InputTensorInfo(..., 1) reads immediately past the four-byte operator.inputs vector.

Reproduction

Build the fixtures with Arm NN's pinned TFLite schema:

flatc -b schema.fbs control.json trigger.json

Build Arm NN's TFLite parser with ASan/UBSan, compile harness.cpp, then:

./harness control.tflite

ASAN_OPTIONS=abort_on_error=1:detect_leaks=0 \
UBSAN_OPTIONS=print_stacktrace=1:halt_on_error=1 \
./harness trigger.tflite

Expected trigger:

ERROR: AddressSanitizer: heap-buffer-overflow
READ of size 4
    #0 armnnTfLiteParser::TfLiteParserImpl::InputTensorInfo(...)
    #1 armnnTfLiteParser::TfLiteParserImpl::ParsePad(...)
0x... is located 0 bytes after 4-byte region [0x...,0x...)

Three interleaved controls exited 0. Three triggers exited 134 with the same sanitizer signature.

Fixture integrity

b4f45a9368c46f8b4ddd095c7cd4e6da1b6c91c37b3907d1d9728017eb6f2b5b  control.tflite
88ace69a3f5be3224941a86d72d03d8424b5e2ad0016e6fe726deac0fbd8a73e  trigger.tflite

Both files are 512 bytes.