tract (sonos) integer-overflow -> OOB read PoC
Proof-of-concept file for a huntr Model Format Vulnerability report against sonos/tract (ONNX loader), CWE-190 -> CWE-125/787.
evil_shape.onnx is a minimal ONNX model with one initializer tensor,
dtype DOUBLE (8 bytes/element), declared shape [2305843009213693953].
shape.iter().product::<usize>() * dt.size_of() (data/src/tensor.rs:282) computes
2305843009213693953 * 8 = 2^64 + 8, which silently wraps (release builds do not
override overflow-checks, confirmed in Cargo.toml) to 8 bytes -
Blob::new_for_size_and_align(8, align) allocates only 8 bytes, while
tensor.len() (computed separately, without this overflow) still reports
2305843009213693953. Later, as_slice_unchecked()
(std::slice::from_raw_parts(ptr, self.len()), tensor.rs:1052-1058) builds a
slice of 2^61+1 elements over the real 8-byte allocation - an out-of-bounds
read far past the buffer, reachable via ordinary constant-folding
(is_uniform/is_uniform_t, tensor.rs:1108-1121) during normal ONNX model
loading (onnx().model_for_path()).
This file's raw_data is 8 bytes, matching the real (wrapped) allocation size -
this is the minimal on-disk shape that reproduces the header-level mismatch;
it does not itself claim to have been executed against a live tract build on
this host (no Rust toolchain available - see report's "Not verified" section).
Impact: memory corruption (out-of-bounds read, potentially exploitable beyond a crash) via a crafted ONNX model file with an oversized declared tensor shape - more severe than a simple allocation-DoS.