This package reproduces a deterministic heap-buffer-overflow read in Arm NN's
TFLite parser. A valid TFLite ABS operator is changed so its input tensor ID
is 2 even though the subgraph contains only two tensors, with valid IDs 0
and 1.
The public parser entry point accepts and unpacks the FlatBuffer, then
TfLiteParserImpl::GetInputs() indexes subgraphPtr->tensors[inputId] without
checking that inputId is in range. The adjacent GetOutputs() path performs
the missing CHECK_TENSOR validation.
The read occurs exactly zero bytes after a 16-byte heap allocation holding the
two tensor pointers. In three repeated trials, the control exited 0 three
times and the trigger aborted with exit code 134 three times.
asan-output.txt contains the complete sanitizer report and
repeated-results.txt contains the repetition summary.
Regenerating the fixtures
The fixtures were generated from TensorFlow's official
tensorflow/compiler/mlir/lite/schema/schema.fbs using FlatBuffers flatc:
CHECKED_NON_NEGATIVE rejects negative values but does not enforce the upper
bound. Call CHECK_TENSOR(model, subgraphIndex, inputId) before indexing,
matching GetOutputs(), and add regression tests for one-past-end and large
operator input tensor IDs.
Impact
An attacker-controlled TFLite model can cause a deterministic native
out-of-bounds read and process termination during model loading, before
inference. This PoC establishes denial of service; it does not claim data
disclosure or code execution.
