sr64/poc-circle-mean-axes-stack-overflow-cwe121

PoC: stack buffer overflow in Samsung/ONE luci-interpreter Mean kernel via axes count > 4 (CWE-121/787)

Loading + executing a crafted Circle model (.circle) with a Mean (reduce-mean) op whose axes tensor has 5 or more elements overflows a fixed-size stack array in the luci-interpreter Mean kernel.

Root cause

compiler/luci-interpreter/src/kernels/Mean.cpp:

static void resolveAxes(const int32_t *axes_data, int num_axes, tflite::MeanParams *params) {
  params->axis_count = num_axes;
  for (int i = 0; i < num_axes; ++i)
    params->axis[i] = static_cast<int16>(axes_data[i]);   // :37  OOB for i>=4
  ...
}
// configure(): int num_axes = axes()->shape().num_elements();  assert(num_axes <= 4);  // :148 release-stripped
// resolveAxes is called from configure() (:154), evalFloat() (:188), evalQuantized() (:208)

tflite::MeanParams.axis is a fixed int16_t axis[4] (Params.h:24-27). num_axes is the element count of the attacker-controlled axes tensor; the only guard is assert(num_axes <= 4) at Mean.cpp:148, which release (NDEBUG) builds strip, and the model loader (loader/nodes/Mean.cpp) performs no axes-count check (only assert(arity == 2)). A crafted .circle whose Mean op has an axes tensor with 5 elements makes resolveAxes write axis[4] past the 4-element stack array → stack OOB write. It fires in configure()'s local MeanParams and again in evalFloat()/evalQuantized(). Distinct from the filed importer bugs (negative subgraph index, CircleConst num_elements) and from the StridedSlice/Unpack kernel bugs.

Reproduce (AddressSanitizer)

g++ -fsanitize=address -g -O0 circle_mean_axes_stack_overflow_harness.cpp -o poc && ./poc
# MeanParams.axis is int16_t[4]; num_axes=5 (assert<=4 stripped) -> resolveAxes writes axis[0..4]
# ==ERROR: AddressSanitizer: stack-buffer-overflow  WRITE of size 2 ... 'params'/axis

Fix

Replace the assert with a hard runtime check that throws when num_axes > 4 (the MeanParams.axis capacity) in configure(), evalFloat() and evalQuantized() before resolveAxes, and/or validate the axes count in the loader.