| { |
| "item_id": "ker-tract_len", |
| "kernel": "tract_len", |
| "advisory": "RUSTSEC-2026-0217", |
| "crate": "tract-nnef", |
| "pre_version": "0.21.15", |
| "post_version": "0.21.16", |
| "advisory_url": "https://github.com/sonos/tract/commit/34c7df2c9bd2a36583e09b52f3e6319bf23102e8", |
| "title": "Integer overflow in tract-nnef NNEF tensor parser leads to out-of-bounds read on model load", |
| "source_file": "src/tensors.rs", |
| "function": "tensor_len_ok", |
| "signature": "pub fn tensor_len_ok(dims: &[usize], bits_per_item: usize, data_size_bytes: usize) -> bool", |
| "spec_doc": "NNEF tensor header consistency: true iff prod(dims) * (bits_per_item / 8) == data_size_bytes in exact arithmetic (false if the product does not fit usize).", |
| "bug_class": "overflow", |
| "fidelity": "verbatim_logic", |
| "extraction_note": "src/tensors.rs read_tensor: unchecked shape product", |
| "witness_args": "&[4294967296usize, 4294967296], 8usize, 0usize", |
| "labels": { |
| "buggy": "tract-nnef@0.21.15", |
| "reference": "tract-nnef@0.21.16" |
| } |
| } |
