You need to agree to share your contact information to access this model

This repository is publicly accessible, but you have to accept the conditions to access its files and content.

YAML Metadata Warning:empty or missing yaml metadata in repo card

Check out the documentation for more information.

ExecuTorch `.pte` — integer overflow → out-of-bounds read & heap write (PoC)

Security PoC for a huntr "Model File Format Vulnerability" report against pytorch/executorch. Gated repository (manual review). Reproduces on pip install executorch==1.3.1 and on ExecuTorch source HEAD 4af91c3d (2026-07-04).

What this is

A malicious .pte model file declares a tensor whose element count × element size overflows size_t. ExecuTorch computes the tensor byte size with an unchecked multiply (compute_numel / TensorImpl::nbytes()), so the overflowed value (e.g. 0) passes the bounds checks in get_constant_buffer_data and HierarchicalAllocator::get_offset_address, while the tensor still reports ~2⁶² elements over a few-KB buffer. Kernels then read or write far out of bounds.

Full write-up: REPORT.md.

Files

build_c.py / run_c.py — build + run the OOB read PoC (sum over an overflowed constant).
build_full.py / introspect.py / patch_sizes.py / run_full.py — build the OOB write PoC (full into an overflowed memory-planned tensor).
valid_c.pte, mal_c.pte — benign vs malicious (read); valid_full.pte, mal_full3.pte (write).
ctrl_c_bignoof.pte — control: large-but-NON-overflowing sizes; the runtime correctly rejects it (proves the bounds check works and only the overflow bypasses it).
asan-evidence/READ_sum.txt, asan-evidence/WRITE_full.txt — AddressSanitizer traces.

Reproduce (release runtime, no build)

pip install executorch==1.3.1
python run_c.py valid_c.pte     # -> tensor([2953665.])  (exit 0)
python run_c.py mal_c.pte       # -> SIGSEGV (OOB read)
python run_full.py valid_full.pte   # -> runs, tensor(17019.)
python run_full.py mal_full3.pte    # -> SIGSEGV (OOB write)

Reproduce with AddressSanitizer (precise READ/WRITE traces)

Build executor_runner with -fsanitize=address (portable kernels), then:

executor_runner --model_path mal_c.pte      # heap-buffer-overflow READ  @ op_sum.cpp:117
executor_runner --model_path mal_full3.pte  # heap-buffer-overflow WRITE @ op_full.cpp:40

See asan-evidence/ for captured output.

Downloads last month: -; Downloads are not tracked for this model. How to track

Inference Providers NEW