tensorflow/lite/).tflite (FlatBuffers)| Protection | Present? | Notes |
|---|---|---|
Integer overflow guard (MultiplyAndCheckOverflow) | ✅ Yes | Prevents wrapping (e.g., INT64_MAX * 2) |
| Per-dimension value cap | ❌ No | dim=32768 accepted without limit |
Maximum tensor byte cap (kMaxTensorBytes) | ❌ No | 4 GB allocation reaches aligned_alloc unchecked |
.tflite file → FlatBuffers parse
interpreter_builder.cc:598 FlatBufferIntArrayToVector(tensor->shape()) ← no per-dim cap
util.cc:220-256 BytesRequired() → MultiplyAndCheckOverflow ← overflow only, no size cap
arena_planner.cc arena_.Allocate(tensor.bytes) ← uncapped
simple_memory_arena.cc aligned_alloc(allocation_size) ← 4 GB, no ceiling[1, 32768, 32768] float32 → 32768 × 32768 × 4 = 4,294,967,296 bytes (4 GB).
BytesRequired() returns kTfLiteOk — no integer overflow. No size ceiling checked.
aligned_alloc(4 GB) fires; on Linux with default overcommit, malloc succeeds and OOM-killer fires.poc_tflite_oom.py — builds evil.tflite and triggers allocate_tensors()evil.tflite — generated by the script1pip install flatbuffers tflite-runtime
2python poc_tflite_oom.pyBytesRequired() (tensorflow/lite/util.cc):1constexpr size_t kMaxTensorBytes = 1ULL << 30; // 1 GB
2if (*bytes > kMaxTensorBytes) return kTfLiteError;