⚠️ SECURITY RESEARCH ARTIFACT: DO NOT CONVERT
This repository contains deliberately malicious ONNX models used as proof-of-concept for a
coordinated-disclosure vulnerability report filed via huntr.com against the
onnx2ncnn converter in Tencent/ncnn.
Do NOT run these files through onnx2ncnn on a machine you care about. poc4_groupnorm_oob.onnx
triggers a heap out-of-bounds read with attacker-controlled length; the others crash the converter
(NULL dereference, out-of-bounds index, or divide-by-zero).
What they trigger
All file-controlled and deterministic, reproduced under AddressSanitizer against a stock build of
tools/onnx/onnx2ncnn.cpp at commit dda2e28.
| File | Finding | Sink | Weakness |
|---|---|---|---|
poc4_groupnorm_oob.onnx |
GroupNorm heap OOB read (lead) | onnx2ncnn.cpp:4707 |
CWE-125 |
poc6_clip_empty_minmax.onnx |
NULL / empty-tensor deref | :173 |
CWE-476 |
poc3_conv_dims0.onnx |
Conv dims(0) OOB |
:4247 |
CWE-129 |
poc1_convtranspose_divzero.onnx |
ConvTranspose divide-by-zero | :4468 |
CWE-369 |
poc2_matmul_divzero.onnx |
MatMul divide-by-zero | :5172 |
CWE-369 |
poc5_clip_empty_scalar.onnx |
Clip input(2) out-of-range |
:4228 |
CWE-129 |
Usage under test: ./o2n_asan <model.onnx> out.param out.bin.
Disclosure status
Filed for coordinated disclosure through huntr. Please do not redistribute or public-post these PoCs until maintainer coordination and the disclosure window have completed. These files exist only to let the maintainers and huntr triagers reproduce and fix the issues.
Contact: huntr handle Ano1X8.