uint64 addition overflow bypasses Buffer.offset bounds check in tflite/core/interpreter_builder.cc #116632

Issue type

Bug

Have you reproduced the bug with TensorFlow Nightly?

Yes

Source

source

TensorFlow version

tf 2.21.0

Custom code

Yes

OS platform and distribution

Linux Ubuntu 24.04 (x86-64)

Mobile device

N/A

Python version

3.12

Bazel version

N/A

GCC/compiler version

N/A

CUDA/cuDNN version

N/A

GPU model and memory

N/A

Current behavior?

#116631

The bounds checks at tensorflow/lite/core/interpreter_builder.cc:380
(Operator.large_custom_options) and :679 (Buffer.data) perform
uint64_t + uint64_t and compare against size_t. When the addition
wraps on overflow, the check returns false and the runtime proceeds
to compute a pointer with allocation_->base() + offset — which also
wraps. A crafted .tflite with Buffer.offset set near 2**64
causes the computed pointer to land outside the model's mmap region.

Affected sites:

• tensorflow/lite/core/interpreter_builder.cc:380
• tensorflow/lite/core/interpreter_builder.cc:679
• No validation of Buffer.offset, Buffer.size,
  Operator.large_custom_options_offset, or
  Operator.large_custom_options_size in
  tensorflow/lite/core/tools/verifier.cc:VerifyModel, so the
  bypass is reachable in every default model-load path.

Schema (tensorflow/compiler/mlir/lite/schema/schema.fbs) defines
both Buffer.offset and Buffer.size as ulong (uint64_t).

Class of bug
Same class as CVE-2021-29605, CVE-2022-23558, CVE-2022-23559 in the
same component. Those fixes targeted int-based arithmetic; this
issue is in the 64-bit external-offset feature (Buffer.offset,
Buffer.size, Operator.large_custom_options_offset,
Operator.large_custom_options_size) added after those patches.

Expected behavior
InterpreterBuilder should reject any model with an external-offset
Buffer whose (offset, size) arithmetic overflows uint64_t, or
whose offset exceeds allocation_->bytes().

Fix
overflow-safe arithmetic at both sites: #116631

if (offset > allocation_->bytes() ||
    size > allocation_->bytes() - offset) {
  return kTfLiteError;
}

Regression test TestBufferOffsetOverflowRejected added to
tensorflow/lite/core/model_test.cc.

Status
Reported to Google OSS VRP (Issue 505514642); working the
merged-patch acceptance path.

Standalone code to reproduce the issue

Full PoC is attached to OSS VRP Issue 505514642.

Minimal reproduction summary:
1. Build a valid .tflite model (any model with at least one
   constant-weight tensor works; the attached PoC uses a two-input
   Add op with an 8-element float32 constant).
2. Patch the weight Buffer's offset to 0xFFFFFFFFFFFFFF00 and
   size to 0x100 using
   `ai_edge_litert.tools.flatbuffer_utils.update_packed_buffer`.
3. Load via `Interpreter(model_path=...).allocate_tensors()` —
   returns success (bounds check bypassed; if the check had fired,
   runtime would emit
   `"Constant buffer N specified an out of range offset."`).
4. Call `invoke()` — dereferences `allocation_->base() + offset`
   (which wraps to `base - 0x100`).

After the fix in https://github.com/tensorflow/tensorflow/pull/116631, step 3 returns
`kTfLiteError` with the expected out-of-range-offset message.

Relevant log output

# Without the fix (ai-edge-litert 2.1.4):
allocate_tensors: SUCCESS (bounds check bypassed)
Thread 1 "python3" received signal SIGSEGV, Segmentation fault.
#0  xnn_f32_vadd_ukernel.avx512f_u32 () from libpywrap_litert_common.so
#1  pthreadpool_parallelize_1d_tile_1d_dynamic ()
#2  xnn_run_operator_with_index ()
#3  xnn_invoke_runtime ()
#4  tflite::xnnpack::SubgraphInvoke(...)
#5  tflite::Subgraph::InvokeImpl()

# With the fix:
ERROR: Constant buffer <N> specified an out of range offset.
InterpreterBuilder returned kTfLiteError.