tract nnef::tensors::read tensor builds a tensor shape from attacker-controlled 32-bit dimensions and computes both the element count product(shape) and the byte allocation product(shape) * size of(dt) with unchecked usize arithmetic. In release builds (no overflow-checks) both products wrap modulo 2^64.

A crafted NNEF .dat tensor can choose dimensions whose wrapped products collapse to a small value that satisfies the header size-consistency check, while the true element count stays astronomically large. read tensor then returns a Tensor whose reported len (e.g. 2^61 + 7) far exceeds its backing heap allocation (e.g. 56 bytes). The unchecked accessor as slice unchecked (slice::from raw parts(ptr, self.len())) subsequently yields a slice spanning ~18 EiB over the small buffer.

The out-of-bounds read fires automatically during model build (no inference required), reachable through the default DatLoader resource loader via the public tract nnef::nnef().model for path / model for read API when the const-folding as uniform fast-path materializes the over-long constant. The always-on primitive is a bounded adjacent-heap over-read (information disclosure); access further past the mapped region SIGSEGVs (denial of service). No out-of-bounds write or code execution was demonstrated.

Affected: every release line prior to the backported fixes — < 0.21.16, 0.22.0–0.22.1, and 0.23.0. The block-quant path had already received an analogous blob-size guard; the dense DatLoader path was missed.

Upgrade to 0.21.16, 0.22.2, or 0.23.1. The fix computes the shape product and byte size with checked mul and rejects the tensor on overflow (commit 34c7df2).