Status: reproduced with ASan on current Arm NN; fresh prior-art gate open

Arm NN's shared TFLite ParseResize() implementation does not verify that the resize size tensor contains the two required values before reading height and width. A structurally valid .tflite file can declare a one-element INT32 size tensor. Arm NN allocates a four-byte vector, copies the valid four-byte buffer into it, then reads sizeTensorData[1] immediately beyond the allocation during model loading.

The same vulnerable function handles RESIZE_BILINEAR and RESIZE_NEAREST_NEIGHBOR. The supplied proof uses RESIZE_BILINEAR.

Tested with:

ParseResize() sizes the local vector from the model-controlled tensor shape:

ValidateBuffer() confirms only that the backing buffer is large enough for that declared one-element tensor. The parser then assumes two elements exist:

There is no check that sizeTensorInfo.GetNumElements() == 2.

Affected source:

Both files are generated with TensorFlow's official v2.19.0 schema and are 544 bytes:

Control:

PoC:

PoC SHA-256: 4da2517674aae61fbffee850e86611cec13f7571a221c19f6d16e30caf4736b2.

Build Arm NN with its TFLite parser and AddressSanitizer, then compile the included public-API harness:

Run:

Before allocating or indexing the size vector, require an INT32 tensor with exactly two elements. Reject any other element count with ParseException. Add regression tests for both resize operators using the supplied one-element size tensor.

The fresh automated scan and semantic web review found no public report naming ParseResize, sizeTensorData[1], or the one-element resize-size mismatch. Public Arm NN TFLite reports found during review cover different operators and different sinks.

Gate record: ../../prior-art/armnn-tflite-resize-single-element-size-oob-read/20260729T022844.950Z.md.