safetensor-poc

safetensors-poc

Target

---

Vulnerability: CWE-190 — Integer Overflow in TensorView::new()

TensorView::new() uses unchecked integer arithmetic (shape.iter().product()) to compute expected buffer size. When an attacker supplies a shape like [2^32, 2^32], the product 2^64 wraps to 0 on 64-bit usize. This causes the data.len() != size check to pass for an empty slice, producing an invalid TensorView. Any subsequent slice access panics, crashing the process.

This is directly inconsistent with validate() in the same file, which uses checked_mul for the identical computation.

Root Cause

// VULNERABLE — safetensors/src/tensor.rs line 755
let n_elements: usize = shape.iter().product();   // ← unchecked overflow
let nbits = n_elements * dtype.bitsize();         // ← unchecked overflow

// SAFE — validate() in tensor.rs line 643
let nelements: usize = info.shape.iter().copied()
    .try_fold(1usize, usize::checked_mul)
    .ok_or(SafeTensorError::ValidationOverflow)?;
let nbits = nelements.checked_mul(info.dtype.bitsize())
    .ok_or(SafeTensorError::ValidationOverflow)?;

Trigger Path

attacker input: shape=[2^32, 2^32], data=&[]
  → TensorView::new()
    → shape.iter().product() = 2^64 → wraps to 0
    → nbits = 0 * 64 = 0 → size = 0
    → data.len() (0) != size (0) → FALSE → TensorView accepted!
  → view.slice(0).unwrap().next()
    → slice.rs:396: range end index 34359738368 out of range for slice of length 0
    → PANIC → process crash (DoS)

Debug builds: panic fires immediately at TensorView::new() (Rust overflow detection) Release builds: silent creation, panic deferred to first slice/iterator access

Vulnerable Files

---

PoC Files

---

Reproduction

Setup

# Install Rust (if not present)
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
export PATH="$HOME/.cargo/bin:$PATH"

# Create the project
mkdir poc && cd poc
mkdir src
cp /path/to/poc.rs src/main.rs
cp /path/to/Cargo.toml .

Debug Build (panic at creation)

cargo run

Expected output:

thread 'main' panicked at .../accum.rs:204:
attempt to multiply with overflow
stack backtrace:
   9: safetensors::tensor::TensorView::new
             at .../safetensors/src/tensor.rs:755:46
[DEBUG MODE] PANIC at TensorView::new — multiply overflow caught.
[+] CWE-190 confirmed — program would crash (DoS) without catch_unwind.

Release Build (silent creation + deferred panic)

cargo run --release

Expected output:

[RELEASE MODE] TensorView::new SUCCEEDED with overflow:
   shape   = [4294967296, 4294967296]
   data    = 0 bytes (should be 137438953472 bytes)
[+] Invalid TensorView created — shape claims 18446744073709551616 elements, data is empty!

[*] Consuming slice iterator (forces &data[0..34359738368] access on empty slice)...
[+] PANIC at slice.rs:396 — DoS confirmed!
         'range end index 34359738368 out of range for slice of length 0'

---

Suggested Fix

pub fn new(dtype: Dtype, shape: Vec<usize>, data: &'data [u8]) -> Result<Self, SafeTensorError> {
    let n_elements: usize = shape
        .iter()
        .copied()
        .try_fold(1usize, usize::checked_mul)
        .ok_or(SafeTensorError::ValidationOverflow)?;  // consistent with validate()

    let nbits = n_elements
        .checked_mul(dtype.bitsize())
        .ok_or(SafeTensorError::ValidationOverflow)?;  // consistent with validate()
    ...
}

---

CVSS

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H — Base Score: 7.5 High

Researcher: Eric Gachara | Hunt date: 2026-05-16