EnigmaConsultant/onnxtrt-external-weights-oob

onnx-tensorrt parseExternalWeights out-of-bounds pointer (numeric offset, no bounds check)

Gated PoC bundle for a huntr Model File Vulnerability report against onnx/onnx-tensorrt (the ONNX external-data weight parser used by NVIDIA TensorRT).

What is here

• poc_offset_oob.onnx - malicious ONNX model. Its single initializer W is marked data_location = EXTERNAL with external_data:
  • location = weights.bin
  • offset = 1073741824 (1 GiB)
  • length = 16
• weights.bin - benign 16-byte sidecar. The mmap covers exactly these 16 bytes.
• make_model.py - script that generated the malicious .onnx (uses the onnx python package).
• harness.cpp - faithful standalone ASan harness that reproduces the exact vulnerable logic of WeightsContext.cpp (parse offset via std::atoll, mmap covering fileSize, weightsPtr = base + offset with no bounds check, then convertDouble() dereference). It parses the offset/length from the SAME .onnx protobuf that onnx-tensorrt parses.
• asan_output.txt - captured AddressSanitizer crash output.

Reproduce

protoc --cpp_out=. onnx.proto
clang++ -std=c++17 -fsanitize=address -g -O0 onnx.pb.cc harness.cpp -o harness \
    $(pkg-config --cflags --libs protobuf)
./harness poc_offset_oob.onnx

Observed: AddressSanitizer SEGV (READ) at the base + offset dereference.

Root cause

WeightsContext.cpp (branch main):

• line 275 / 279: offset / length come straight from attacker-controlled external_data via std::atoll (no range check).
• line 202: mmap(path) maps exactly fileSize bytes.
• line 212: auto* weightsPtr = static_cast<char*>(memoryMap.first) + offset; - no check that offset >= 0, offset <= fileSize, or offset + length <= fileSize.
• line 309 (convertOnnxWeights, DOUBLE path): convertDouble() dereferences weightsPtr, reading length bytes from the out-of-bounds region.

The only path guard (../ traversal check, lines 166-179) is unrelated to numeric bounds.

This is a legitimate, authorized security-research artifact. Access is gated.