htdy7703/pytorch-mobile-isinstance-type-oob-poc-20260709

PyTorch mobile ISINSTANCE type OOB PoC

This repository demonstrates an out-of-bounds TypePtr read in PyTorch's lite-interpreter bytecode runtime.

What this PoC shows:

• a valid .ptl model can be mutated by changing only one serialized ISINSTANCE operand
• the function's serialized type table still has exactly 1 entry
• changing ISINSTANCE.N from 1 to 2 makes forward() crash the official torch-2.13.0+cpu wheel with SIGSEGV
• the malformed model still returns normally on matching list input, but crashes on common non-matching inputs such as a tensor

What this PoC does not show:

• a stable memory disclosure primitive
• code execution
• a claim about every TorchScript loading path

Verified runtime:

• official torch-2.13.0+cpu wheel

Run:

python3 poc_mobile_isinstance_type_oob.py --isinstance-n 1
python3 poc_mobile_isinstance_type_oob.py --isinstance-n 2