Views
No views yet
ai.onnx.ml LabelEncoder-v4 / TreeEnsemble-v5)Security research artifact for responsible disclosure (Protect AI / huntr Model File Vulnerability program). These are malformed.onnxmodels that crashonnx.shape_inference.infer_shapes()(SIGSEGV / null-pointer dereference). Read-only DoS — no code execution. Do not load untrusted models in production services.
onnx/onnx — reference library, C++ shape inference.
APIs: onnx.shape_inference.infer_shapes() (Python) / onnx::shape_inference::InferShapes() (C++).
Reproduced on: released onnx==1.22.0 (rc 139 / SIGSEGV) and onnx HEAD (7989b3c) under AddressSanitizer.
Class: CWE-476 (NULL Pointer Dereference) → Denial of Service.ai.onnx.ml operator shape-inference functions read input 0's element type via
ctx.getInputType(0)->tensor_type().elem_type() without checking getInputType(0) != nullptr.
getInputType(0) is nullptr when input 0 has no known type (e.g. the node consumes a name that is not a
typed graph input / value_info / initializer — trivial in an untrusted model), so the dereference reads NULL+0x28
and crashes.| Operator | Domain / version | Vulnerable line |
|---|---|---|
LabelEncoder | ai.onnx.ml v4 | onnx/defs/traditionalml/defs.cc:398 |
TreeEnsemble | ai.onnx.ml v5 | onnx/defs/traditionalml/defs.cc:1143 |
hasInputShape(ctx, 0); these two recently added ops do not. The pattern
ctx.getInputType(N)->tensor_type()... occurs ~200× across onnx/defs — the fix is a per-site null guard (or
centralizing the check).models/)| file | effect |
|---|---|
poc_labelencoder_nullderef.onnx | infer_shapes() → SIGSEGV via LabelEncoder (ai.onnx.ml v4) |
poc_treeensemble_nullderef.onnx | infer_shapes() → SIGSEGV via TreeEnsemble (ai.onnx.ml v5) |
asan_*.txt are the full AddressSanitizer null-deref stacks (HEAD build). onnx_fuzz_harness.cpp is the
libFuzzer harness (bytes → ModelProto → InferShapes + check_model) used to discover these.1import onnx, onnx.shape_inference as si
2si.infer_shapes(onnx.load("models/poc_labelencoder_nullderef.onnx")) # -> SIGSEGV
3si.infer_shapes(onnx.load("models/poc_treeensemble_nullderef.onnx")) # -> SIGSEGV
4# pip install onnx==1.22.01if (ctx.getInputType(0) == nullptr || !ctx.getInputType(0)->has_tensor_type()) {
2 fail_shape_inference("input 0 type is required");
3}