kodareef5/onnx-reshape-overflow-poc

ONNX Integer Overflow PoC (CWE-190)

Vulnerability

The ONNX C++ library computes tensor dimension products using int64_t multiplication without overflow checking in checker.cc and tensor_proto_util.cc.

Tensor dimensions [4294967296, 4294967296] (2^32 × 2^32) produce a product of 2^64 which wraps to 0 in int64_t. Any code using this product for buffer allocation gets malloc(0), leading to heap buffer overflow when the actual tensor data is written.

Files

• overflow_dims.onnx — Model with Constant tensor whose dims overflow to 0
• overflow_reshape.onnx — Model with Reshape op using overflowing target dims
• poc.py — Proof of concept script

Reproduce

pip install onnx
python poc.py

Output

Checker output: TensorProto (tensor name: overflow_constant) is 0-element but contains data!

*** CONFIRMED: C++ int64_t overflow ***
*** Dim product wrapped to 0, but tensor has actual data