Stream: git-wasmtime

Topic: wasmtime / PR #14959 wasi-nn: check input tensor data len...

Wasmtime GitHub notifications bot (Oct 23 2026 at 07:52):

netliomax25-code opened PR #14959 from netliomax25-code:wasi-nn-check-tensor-data-length to bytecodealliance:main:

Related: #14532 (the same length check for the ONNX backend) and #14437 (a different wasi-nn host memory disclosure).

The PyTorch backend builds input tensors with tch::Tensor::from_data_size, passing the guest's dimensions and data straight through. That forwards to libtorch's at_tensor_of_data, which allocates numel(dims) elements and memcpys numel * element_size bytes from the data pointer without looking at the slice length. A guest that sets an fp32 input with dimensions [4096] and only 4 bytes of data, through either WITX set_input or WIT compute, makes the host copy roughly 16 KiB of adjacent heap memory into the tensor, where it feeds inference and can come back out through get_output. A standalone program against tch 0.17 / libtorch 2.4.0 calling Tensor::from_data_size(&[0; 4], &[4096], Kind::Float) got back 92288 non-zero bytes over 64 iterations.

This checks that the data length equals the overflow-checked product of the dimensions and the element size before calling into tch, the same check #14532 added for ONNX. The OpenVINO backend is missing the same check at its two input sites; there copy_from_slice panics the host on a mismatch, so those return an error now as well. The underlying unsoundness is arguably in tch's safe from_data_size and may be worth reporting there too, but the check is needed here either way.

Tested with --features pytorch against libtorch 2.4.0 on macOS arm64: the new unit test passes, and the existing nn_witx_image_classification_pytorch and nn_wit_image_classification_pytorch tests still pass. I could not run the OpenVINO tests locally since OpenVINO is not installed here; that change is a length comparison ahead of the existing copy_from_slice.

Wasmtime GitHub notifications bot (Oct 23 2026 at 07:52):

netliomax25-code removed the review request for wasmtime-wasi-reviewers from PR #14959.

Wasmtime GitHub notifications bot (Oct 23 2026 at 07:52):

netliomax25-code requested rvolosatovs for a review on PR #14959.

Wasmtime GitHub notifications bot (Oct 23 2026 at 07:52):

netliomax25-code requested wasmtime-wasi-reviewers for a review on PR #14959.

Wasmtime GitHub notifications bot (Oct 23 2026 at 15:04):

alexcrichton commented on PR #14959:

cc @jlb6740 @rahulchaphalkar

Wasmtime GitHub notifications bot (Oct 23 2026 at 15:04):

alexcrichton removed the review request for rvolosatovs from PR #14959.

Wasmtime GitHub notifications bot (Oct 23 2026 at 15:04):

alexcrichton added the label wasi-nn on PR #14959.

Wasmtime GitHub notifications bot (Oct 23 2026 at 22:24):

:thumbs_up: rahulchaphalkar submitted PR review:

Thanks, looks good!

Wasmtime GitHub notifications bot (Oct 23 2026 at 22:30):

:thumbs_up: alexcrichton submitted PR review.

Wasmtime GitHub notifications bot (Oct 23 2026 at 22:30):

alexcrichton added PR #14959 wasi-nn: check input tensor data length in pytorch and openvino to the merge queue.

Wasmtime GitHub notifications bot (Oct 24 2026 at 11:06):

:check: alexcrichton merged PR #14959.

Wasmtime GitHub notifications bot (Oct 24 2026 at 11:06):

alexcrichton removed PR #14959 wasi-nn: check input tensor data length in pytorch and openvino from the merge queue.

Last updated: Oct 31 2026 at 23:03 UTC