OneFlow Shape Mismatch Vulnerability Leading to Denial-of-Service

A shape mismatch vulnerability has been identified in OneFlow version 0.9.0. This vulnerability allows attackers to cause a denial-of-service by supplying crafted tensor shapes. The issue arises when the dimensions of tensors do not align as expected, leading to segmentation faults and core dumps.

Impact

Exploitation of this vulnerability causes a segmentation fault, resulting in a core dump.

Reproduction

The vulnerability can be reproduced by calling the 'flow.eye' function to create a tensor, and then adding a diagonal tensor with a mismatched shape. This operation causes a shape inconsistency that leads to a segmentation fault.