aleff-huggingface/tflite-parse-tensors-sigsegv-poc

TFLite InterpreterBuilder::ParseTensors SIGSEGV PoC

This repository contains a proof-of-concept .tflite model file that triggers a deterministic native SIGSEGV when loaded by TensorFlow Lite.

The crash occurs during interpreter construction, before allocate_tensors() or invoke(), inside:

tflite::impl::InterpreterBuilder::ParseTensors(...)

Files

crash.tflite              Proof-of-concept malformed TFLite model
reproduce_tf.py           Minimal TensorFlow reproduction script
requirements.txt          Python dependency for stable TensorFlow reproduction
SHA256SUMS                SHA-256 checksum for the PoC file
evidence/                 GDB, reproducibility, and diff evidence

PoC hash

ccc2cee82c0b90147a0ca5babacd3bad67ae93a6a3cbce5bb4ba52e2e34cc510  crash.tflite

Tested versions

The crash was reproduced on:

tensorflow==2.21.0
tf-nightly==2.22.0-dev20260525
ai-edge-litert==2.1.5
Python 3.12

Reproduction

python3.12 -m venv /tmp/tflite-repro
source /tmp/tflite-repro/bin/activate

python -m pip install --upgrade pip
python -m pip install -r requirements.txt

ulimit -c 0
python reproduce_tf.py crash.tflite
echo "rc=$?"

Expected behavior

Malformed .tflite model files should be rejected cleanly with an exception or error status.

Actual behavior

The process terminates with SIGSEGV:

[runtime] tensorflow 2.21.0
[phase] before tf.lite.Interpreter()
Fatal Python error: Segmentation fault
rc=139

GDB frame

Program received signal SIGSEGV, Segmentation fault.

#0  tflite::impl::InterpreterBuilder::ParseTensors(...)
#1  tflite::impl::InterpreterBuilder::operator()(...)
#2  tflite::interpreter_wrapper::InterpreterWrapper::CreateInterpreterWrapper(...)
#3  tflite::interpreter_wrapper::InterpreterWrapper::CreateWrapperCPPFromFile(...)

Reproducibility

TensorFlow stable:

run    rc    phase
1      139   before_interpreter+sigsegv
2      139   before_interpreter+sigsegv
3      139   before_interpreter+sigsegv

tf-nightly:

tensorflow 2.22.0-dev20260525
run 1: rc=139
run 2: rc=139
run 3: rc=139

LiteRT:

ai-edge-litert==2.1.5
rc=139

Mutation details

The crashing file was derived from a valid seed model by deleting 43 bytes:

seed_len=952
case_len=909
common_prefix=592
common_suffix=317
seed_changed_region_len=43
case_changed_region_len=0
likely_mutation=delete offset=592 length=43

Impact

A crafted .tflite model file can terminate a process that attempts to load it using TensorFlow Lite / LiteRT. This is a native parser/loader crash, not a handled Python exception.

No arbitrary code execution is claimed.