NULL Pointer Dereference WRITE in TFLite REDUCE_PROD kernel via crafted .tflite model
Reproduction
Python API
import tensorflow as tf
interpreter = tf.lite.Interpreter(model_path="poc.tflite")
interpreter.allocate_tensors()
interpreter.invoke() # CRASH
See reproduce.sh for full build instructions.
poc.tflite — Crafted TFLite model that triggers the vulnerability
reproduce.sh — Full reproduction script (clone… See the full description on the dataset page:
https://huggingface.co/datasets/Rammadaeus/tflite-reduce-ref-oob-write-poc.