YAML Metadata Warning:empty or missing yaml metadata in repo card
Check out the documentation for more information.
PoC: OOB read in PyTorch mobile interpreter ISINSTANCE opcode (CWE-125)
Loading a crafted PyTorch Mobile model (.ptl) and running an ISINSTANCE instruction reads out of bounds.
Root cause
torch/csrc/jit/mobile/interpreter.cpp:
case ISINSTANCE: {
at::ArrayRef<TypePtr> types(&code.types_.at(inst.X), inst.N); // L348
isinstance(stack, types); // iterates + dereferences each
}
// isinstance() (L33-41):
for (const TypePtr& candidate : types) if (ty->isSubtypeOf(*candidate)) ... // reads types[i]
code.types_.at(inst.X) guards only inst.X (throws on OOB), but the ArrayRef is then built with
length inst.N — a uint16_t (0..65535) loaded verbatim from the .ptl mobile bytecode
(parse_bytecode.cpp) — with no check that inst.X + inst.N <= code.types_.size(). isinstance()
iterates the full ArrayRef, so up to 65535 TypePtr entries past the end of the types_ vector are
read and dereferenced → heap OOB read (crash / type confusion / info leak). Reachable via the standard
torch::jit::_load_for_mobile() API (no trust opt-in).
Reproduce (AddressSanitizer)
pytorch_isinstance_oob_harness.cpp reproduces the ArrayRef-without-bounds + iterate verbatim:
g++ -fsanitize=address -g -O0 pytorch_isinstance_oob_harness.cpp -o poc && ./poc
# ArrayRef(&types_[inst.X], inst.N) spans 65535 entries past a 1-element table; iterating...
# ==ERROR: AddressSanitizer: heap-buffer-overflow READ of size 8
# #0 isinstance ... 0x... is located 0 bytes after the 1-element types_ vector
A real trigger is a .ptl whose mobile bytecode has an ISINSTANCE instruction with inst.X valid but
inst.N exceeding types_.size() - inst.X.
Fix
Validate inst.X + inst.N <= code.types_.size() before constructing the ArrayRef (mirroring the
.at(inst.X) bounds check for the span length).