willardj/armnn-intovfl-poc

Arm NN Integer Overflow PoC — GetNumElements()

Vulnerability: Integer overflow in TensorShape::GetNumElements() (src/armnn/Tensor.cpp:181-209)

The Bug

GetNumElements() multiplies tensor dimensions using unsigned int (32-bit) with no overflow check:

unsigned int count = 1;
for (unsigned int i = 0; i < m_NumDimensions; ++i) {
    count *= m_Dimensions[i];  // NO OVERFLOW CHECK
}

PoC Model

poc_armnn_overflow.tflite — A patched TFLite model with a tensor whose shape is [65536, 65536].

When loaded by Arm NN's TFLite parser:

1. GetNumElements() computes 65536 * 65536 = 0 (unsigned int overflow)
2. GetNumBytes() returns sizeof(float) * 0 = 0
3. CheckBufferSize() at TfLiteParser.cpp:270 compares overflowed value (0) against buffer size — check passes
4. new T[0] allocates a tiny buffer (TfLiteParser.cpp:653)
5. Tensor is used with original [65536, 65536] shape — out-of-bounds heap access

Fix

Use uint64_t accumulator or checked multiplication (e.g., __builtin_mul_overflow) in GetNumElements().

Affected Code

• src/armnn/Tensor.cpp:190-197 — GetNumElements() (core, affects ALL parsers)
• src/armnn/Tensor.cpp:429 — GetNumBytes() (multiplies overflowed result)
• src/armnnTfLiteParser/TfLiteParser.cpp:270,653,663 — buffer check + allocation + memcpy