codeconflict7/tensorrt-onnx-oob-poc

TensorRT ONNX Parser Heap OOB Read PoC

Security research PoC — DO NOT USE AS A REAL MODEL.

Files

• poc_heap_overflow.py — Python script that crafts malicious .onnx files and triggers OOB reads
• poc_external_oob.onnx — Crafted ONNX model with external weights offset past file boundary
• poc_double_oob.onnx — Crafted ONNX model with shape/data count mismatch (convertDouble OOB)
• weights.bin — 16-byte external weights file used by poc_external_oob.onnx

Reproduce

pip install tensorrt==10.15.1 onnx
python poc_heap_overflow.py

What it does

Finding A: External weights with offset=999999 on a 16-byte file — parser succeeds silently with OOB pointer. Finding B: shape=[50,50] with only 4 doubles — convertDouble reads 2496 heap elements, garbage visible in TRT warnings.