Views
No views yet
SliceIterator::new()safetensors/src/slice.rs has 7 unchecked +1 operations on usize values (lines 302, 307, 309, 311, 313, 314, 316). When the operand is usize::MAX, the addition overflows → panic (process crash in debug, silent wrap in release).1cp poc_test.rs safetensors/tests/poc_test.rs
2cd safetensors
3cargo test --test poc_test -- --nocaptureslice.rs:316, :302, :309 — "attempt to add with overflow"1pip install safetensors
2python poc.pyi64 range). The Rust crate API (TensorView::sliced_data) is directly vulnerable.1// slice.rs:316
2TensorIndexer::Select(s) => (*s, *s + 1),
3// ^^^^^ overflows when s = usize::MAX1TensorIndexer::Select(s) => {
2 let stop = s.checked_add(1).ok_or(InvalidSlice::SliceOutOfRange {
3 dim_index: i, asked: *s, dim_size: shape,
4 })?;
5 (*s, stop)
6},| File | Purpose |
|---|---|
poc_test.rs | Rust unit test — crashes at 3 sites |
poc.py | Python demo + safetensors file generator |
poc.safetensors | Valid model file (100×64 F32 embedding) |