Repository navigation
Conversation
|
This PR closes #7029 |
|
@snnn anything needed from me to merge? |
|
Recently we moved the code to a different dir. So, I created a new branch ,apply your change to the new folder, and submitted it as #7196 . |
|
@snnn then the patch wont be credited properly? |
Python slicing silently clamps out-of-range indices, allowing crafted .tflite models to produce aliased buffers and corrupted re-serialized output. Validate each (offset, size) pair against the model bytearray length using overflow-safe arithmetic (size > model_len - offset) before slicing, for both buffer.offset/size and op.largeCustomOptions offset/size. Adds regression tests covering uint64 wrap, offset exceeding model length, size exceeding remaining bytes, and accepted boundary cases, plus the corresponding BUILD target. Re-applied at the new tree location (litert/python/tools/) following upstream directory reorganization. Original review and approval at google-ai-edge#7028; closed PR google-ai-edge#7196 superseded by this update per maintainer request to preserve contributor attribution.
34faca7 to
3c300ed
Compare
|
@snnn all 8 checks are green. Anything else needed from me before merge? |
|
@snnn would you happen to have an update on this? |
…-hardening-20260422
|
@pyu10055 @niuchl @reillyeon would you be able to assist with this? |
|
@jl45G can this one also be closed? |
|
@snnn This PR has been idle since May. State recap: you approved it on Apr 24, CLA is signed, and all 8 checks are green. After the directory move I force-pushed the change to litert/python/tools/ so it applies to the current tree, and #7196 was closed in favor of this PR. Could you merge it or queue the import? If it has since been superseded by another change, let me know and I will close it out. |
|
@sourcelite @jl45G @snnn This is ready to land and is blocked only on the workflow-approval gate. State: approved by snnn (write access), CLA green, check-changes green, copybara reports no internal file affected, no merge conflicts. The only item outstanding is the 6 workflow runs awaiting maintainer approval, which is holding the GitHub Actions Scan check at "expected, waiting to run." Could you approve the pending workflow runs and merge once they pass? |
What
tflite/tools/flatbuffer_utils.pyinread_model_from_bytearray()slices the model bytearray using
Buffer.offset/Buffer.sizeandOperator.largeCustomOptionsOffset/...Sizewithout lengthvalidation. Python slicing clamps out-of-range indices silently, so
an
(offset, size)that wraps when added asuint64or thatexceeds the bytearray length does not raise. It returns a clamped
or aliased slice instead.
Downstream, the LiteRT Python quantizer operates on these buffers as
if they were distinct objects, producing corrupted output tensors
when re-serialized.
How
Added overflow-safe bounds checks before each slice:
Applied at both slice sites (Buffer and largeCustomOptions).
Relationship to TensorFlow
The same arithmetic pattern is being fixed in the C++ TFLite runtime
(
interpreter_builder.cc) under a companion PR totensorflow/tensorflow. This change closes the Python-side toolingthat consumes the same external-offset feature.
Test
tflite/tools/flatbuffer_utils_overflow_test.pycovers:(offset, size)whose uint64 sum wraps belowmodel_len= rejectedoffsetalone exceedsmodel_len= rejected(offset, size)withinmodel_len= acceptedTo run: