Hugging Face's logo

luckilytsh
/
executorch-methodmeta-sizes-oob-poc

ExecuTorch
security
poc
Model card Files
xet
 Community

You need to agree to share your contact information to access this model

This repository is publicly accessible, but you have to accept the conditions to access its files and content.

Log in or Sign Up to review the conditions and access this model content.

Harmless PoC: ExecuTorch MethodMeta calculate_nbytes sizes OOB

MethodMeta::input_tensor_meta → TensorInfo::create → calculate_nbytes iterates sizes[i] using a forged FlatBuffer vector length with no bound against the program buffer. Under default Program::Verification::Minimal (or Release with ET_ENABLE_PROGRAM_VERIFICATION=0), querying MethodMeta triggers ASan heap-buffer-overflow READ at method_meta.cpp:63.

Distinct from WebGPUDelegateHeader and PTE segment hardening (#16704/#18662/#19268/#19904).

Files

  • poc_method_meta_asan.cpp, asan.log (sizes-oob)
  • asan_null_delegates.log, asan_null_values.log (related MethodMeta NPDs)
  • NOTES.md
# Build against executorch @ 8077bb60; see NOTES.md
./poc_method_meta_asan sizes-oob
Downloads last month

-

Downloads are not tracked for this model. How to track
Inference Providers NEW
This model isn't deployed by any Inference Provider. 🙋 Ask for provider support