You need to agree to share your Hugging Face information to access this model

This repository is publicly accessible, but you have to accept the conditions to access its files and content.

TFLM AllocateDecompressionMemory size_t overflow allows OOB WRITE

Harmless ASan crash PoC for Huntr MFV.

Pin: tensorflow/tflite-micro @ 096563546742ba81adb6f012ab718d196a48e02d

Summary

Under USE_TFLM_COMPRESSION, MicroContext::AllocateDecompressionMemory computes total = bytes + (aligned_start - start) and compares total + allocations <= region->bytes without overflow-safe arithmetic. With an honest small AlternateMemoryRegion and a huge request plus non-zero alignment padding, total wraps and the fit check passes, returning a pointer into the tiny region → ASan stack/heap-buffer-overflow WRITE. Distinct from BinQuant decompress and compression-meta-subgraph submits.

Reproduce

cd lab/runs/tflite_decompress_memory
./build_and_run.sh
# primary: repro_alloc_overflow_padding_asan / repro_alloc_overflow_heap_asan

See NOTES.md. protectai-bot granted before upload.

Downloads last month: -; Downloads are not tracked for this model. How to track

Inference Providers NEW

This model isn't deployed by any Inference Provider. 🙋 Ask for provider support