Integer overflow in memory copy size calculation in Samsung Open Source ONE could lead to invalid memory operations with large tensor shapes.
Affected version is prior to commit 1.30.0.
The following code is for security research and authorized testing only.
python
# PoC Concept for Integer Overflow in Tensor Size Calculation
# Target: Samsung Open Source ONE < 1.30.0
# This script demonstrates the logic that triggers the overflow.
def calculate_tensor_size(dimensions, dtype_size=4):
"""
Simulates the vulnerable size calculation logic.
"""
size = 1
for dim in dimensions:
size *= dim
# Simulate 32-bit integer overflow (wrap around)
MAX_UINT32 = 0xFFFFFFFF
if size > MAX_UINT32:
size = size % (MAX_UINT32 + 1)
return size * dtype_size
# Scenario: Attacker crafts a tensor with dimensions that cause overflow
# Example: A tensor with shape [0x10000, 0x10000] of 4-byte floats
# Actual size = 0x10000 * 0x10000 * 4 = 2^32 * 4 bytes (Huge)
# Calculated size (32-bit) = 0 * 4 = 0 bytes
malicious_shape = [0x10000, 0x10000]
allocated_buffer_size = calculate_tensor_size(malicious_shape)
print(f"Malicious Shape: {malicious_shape}")
print(f"Allocated Buffer Size (based on overflowed calc): {allocated_buffer_size} bytes")
print("Vulnerability Triggered: attempting to copy massive data into tiny buffer...")
# Real-world exploitation would involve passing this tensor to the ONE runtime,
# causing a crash or memory corruption during the memcpy operation.