You need to agree to share your contact information to access this model

This repository is publicly accessible, but you have to accept the conditions to access its files and content.

TFLM DecompressTensorToBuffer BinQuant dims channels vs value-table stride OOB READ

Harmless ASan crash PoC for Huntr MFV.

Pin: tensorflow/tflite-micro @ 096563546742ba81adb6f012ab718d196a48e02d

Summary

Under USE_TFLM_COMPRESSION, MicroContext::DecompressTensorToBuffer uses ElementCount and dims[channel_axis] as num_channels without checking against the value-table layout implied by value_table_channel_stride (allocator divides table size by scale()->size()). When dims[axis] > scale()->size(), channel advances walk past the table → ASan stack-buffer-overflow READ in DecompressToBufferWidth4_16. Distinct from submitted decompress-common LUT index OOB.

Reproduce

cd lab/runs/tflite_decompress_binquant
# primary: repro_mc_channels_vs_stride_asan
# control: repro_mc_channels_vs_stride_control_asan

See NOTES.md. protectai-bot granted before upload.

Downloads last month: -; Downloads are not tracked for this model. How to track

Inference Providers NEW

This model isn't deployed by any Inference Provider. 🙋 Ask for provider support