Talson/mnn-dims-oob-poc
MNN computeShapeForBlob dims overflow + outputIndexes OOB Vulnerability CWE-787: Out-of-bounds Write in MNN model loading (InitNet.cpp). Bug 1: dims overflow — heap-buffer-overflow WRITE computeShapeForBlob() loops over Blob.dims from the model file and writes each element into a fixed dim[MNN_MAX_TENSOR_DIM=9] array. The FlatBuffers schema allows arbitrary dims vector length, but the C++ struct is fixed: // InitNet.cpp:24-26… See the full description on the dataset page: https://huggingface.co/datasets/Talson/mnn-dims-oob-poc.
Conversations for this repository live on Hugging Face.
CoolFace shows imported repositories read-only. Posting into someone else’s repository from here would need an authorised integration and the account holder’s consent, so the link goes to the source instead.
Open discussions on Hugging Face