Talson/mnn-dims-oob-poc

MNN computeShapeForBlob dims overflow + outputIndexes OOB Vulnerability CWE-787: Out-of-bounds Write in MNN model loading (InitNet.cpp). Bug 1: dims overflow — heap-buffer-overflow WRITE computeShapeForBlob() loops over Blob.dims from the model file and writes each element into a fixed dim[MNN_MAX_TENSOR_DIM=9] array. The FlatBuffers schema allows arbitrary dims vector length, but the C++ struct is fixed: // InitNet.cpp:24-26… See the full description on the dataset page: https://huggingface.co/datasets/Talson/mnn-dims-oob-poc.