Downloads · 30 days
0
0% of all-time downloads
huntr-poc-bug11-executorch-pte-nullptr-write-dos
Abhnv7/huntr-poc-bug11-executorch-pte-nullptr-write-dos
huntr-poc-bug11-executorch-pte-nullptr-write-dos is a machine learning model from Abhnv7. Use it for the machine learning task on the model card, and read the license before you ship it in a product.
Missing nullptr check after allocateList<EValue() in Method::parsevalues (runtime/executor/method.cpp:514-532) causes SIGSEGV when loading a crafted .pte model with a large IntList that exhausts the method allocator.
All-time downloads
8
Public
Repo size
400 KB
Likes
0
Public
Repo makeup
Click a slice to open those files.
.pte400 KB · 84%
At a glance
- Access
- Public
- Created
- Jun 8, 2026
- Updated
- Jun 8, 2026
- SHA
- 8cb48133
Model card
From the Hugging Face model README
BUG11 — ExecuTorch allocateList nullptr write (null deref crash)
Missing nullptr check after allocateList<EValue*>() in Method::parse_values
(runtime/executor/method.cpp:514-532) causes SIGSEGV when loading a crafted .pte
model with a large IntList that exhausts the method allocator.
- Repo: https://github.com/pytorch/executorch
- Latest commit tested: 968fff9821f9cf8ebe9dc547ee454f2bb2c51a87 (origin/main)
- Pinned comparison: f3b66dccdef22d6c6d35bbfe76a3afaf433dddb2 (code identical)
- Vulnerable code: runtime/executor/method.cpp:514-532
- Severity: Medium (null pointer write / DoS, CWE-476)
Reproduce
python3 generate_poc_bug11.py # writes poc_bug11.pte (~400KB, 50K IntList)
# build executorch_core, compile bug11_harness with 32KB method allocator
./bug11_harness poc_bug11.pte # -> SIGSEGV (exit 139)
Result
SIGSEGV at method.cpp:532: evalp_list[j] = &values_[...]; (evalp_list = 0x0)
PoC SHA256: fbca918f2e4b7c297840c93ca0c29ddb9db2a712f9af1447218ffa0f09b0be7f
- Created
- Jun 8, 2026
- Updated
- Jun 8, 2026