Arm NN TFLite operator opcode-index out-of-bounds PoC
This package reproduces a deterministic heap-buffer-overflow read in Arm NN's
TFLite parser. An operator-controlled opcode_index is used to index the
model's operator_codes vector before any upper-bound validation.
The trigger sets opcode_index to 2 while the vector has two entries, with
valid indices 0 and 1.
The read occurs exactly zero bytes after the 16-byte allocation holding the
two OperatorCodeT pointers. Three controls parsed successfully and three
triggers aborted with exit code 134.
asan-output.txt contains the complete sanitizer report and
repeated-results.txt contains the repetition summary.
Regenerating the fixtures
The fixtures were generated from TensorFlow's official
tensorflow/compiler/mlir/lite/schema/schema.fbs using FlatBuffers flatc:
The later range check validates builtinCode, not op->opcode_index.
Validate op->opcode_index < m_Model->operator_codes.size() and reject a null
opcode entry before dereferencing it. Add regression tests for a one-past-end
and large opcode index.
Impact
An attacker-controlled TFLite model can cause a deterministic native
out-of-bounds read and process termination during model loading, before
inference. This PoC establishes denial of service; it does not claim data
disclosure or code execution.
