You need to agree to share your contact information to access this model

This repository is publicly accessible, but you have to accept the conditions to access its files and content.

YAML Metadata Warning:empty or missing yaml metadata in repo card

Check out the documentation for more information.

ExecuTorch .pte Integer Overflow in compute_numel() PoC

Vulnerability

compute_numel() in runtime/core/portable_type/tensor_impl.cpp multiplies tensor dimensions without overflow checks. The overflow check in program_validation.cpp was written but commented out (lines 48-57, 67-79). The default verification mode (Minimal) skips calling the validation function entirely.

Reproduce

from executorch.runtime import Runtime
runtime = Runtime.get()
program = runtime.load_program(open('poc_numel_overflow.pte', 'rb').read())
method = program.load_method('forward')
# On 32-bit embedded targets: numel overflow → heap buffer overflow

Files

poc_numel_overflow.pte — Patched add.pte with INT32_MAX tensor dimension
poc_numel_overflow.py — Generator script

Affected

ExecuTorch all versions through latest (1.2.0+).

Downloads last month: 1

Inference Providers NEW

This model isn't deployed by any Inference Provider. 🙋 Ask for provider support