File size: 1,001 Bytes
4951e76 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 | {
"item_id": "ker-tract_len",
"kernel": "tract_len",
"advisory": "RUSTSEC-2026-0217",
"crate": "tract-nnef",
"pre_version": "0.21.15",
"post_version": "0.21.16",
"advisory_url": "https://github.com/sonos/tract/commit/34c7df2c9bd2a36583e09b52f3e6319bf23102e8",
"title": "Integer overflow in tract-nnef NNEF tensor parser leads to out-of-bounds read on model load",
"source_file": "src/tensors.rs",
"function": "tensor_len_ok",
"signature": "pub fn tensor_len_ok(dims: &[usize], bits_per_item: usize, data_size_bytes: usize) -> bool",
"spec_doc": "NNEF tensor header consistency: true iff prod(dims) * (bits_per_item / 8) == data_size_bytes in exact arithmetic (false if the product does not fit usize).",
"bug_class": "overflow",
"fidelity": "verbatim_logic",
"extraction_note": "src/tensors.rs read_tensor: unchecked shape product",
"witness_args": "&[4294967296usize, 4294967296], 8usize, 0usize",
"labels": {
"buggy": "tract-nnef@0.21.15",
"reference": "tract-nnef@0.21.16"
}
} |