ONNX check_model Consistency Gaps (Validation Hardening Report)
Summary
In ONNX 1.21.0, onnx.checker.check_model() accepts multiple malformed tensor encodings that are internally inconsistent:
raw_data byte length does not match dims * sizeof(dtype).External tensor data (data_location=EXTERNAL) can load bytes shorter than declared tensor size.
Tensor element-count multiplication can overflow signed int64_t in checker logic.
These are validator consistency gaps : malformed models pass official checker validation and are only rejected/fail later in downstream processing.
Tested Context
Package: onnx==1.21.0
Python: 3.10
Date: 2026-05-08
PoC: C:\Users\yibai7\audit\submissions\onnx\poc_onnx_bypass.py
Confirmed Finding 1: raw_data Size Mismatch Passes Checker
Evidence
check_tensor computes nelem and enforces field presence, but does not compare tensor.raw_data().size() against expected byte size:
D:\python3\Lib\site-packages\onnx\checker.cc:129-132D:\python3\Lib\site-packages\onnx\checker.cc:139-143
By contrast, helper API does enforce length:
D:\python3\Lib\site-packages\onnx\helper.py:453-456
Reproduced Behavior
Declared tensor: FLOAT[1000000] (expected 4,000,000 bytes)
Actual raw_data: 4 bytes
onnx.checker.check_model(...): passes
Confirmed Finding 2: External Data Length Mismatch Passes Checker + Loads
Evidence
For external tensors, checker validates location presence then returns, without size-consistency check against tensor dimensions:
D:\python3\Lib\site-packages\onnx\checker.cc:107-127
External loader validates file bounds (offset/length <= file size) but not tensor semantic size:
D:\python3\Lib\site-packages\onnx\external_data_helper.py:102-134D:\python3\Lib\site-packages\onnx\external_data_helper.py:184-206
Reproduced Behavior
Declared tensor: FLOAT[1000000]
External file content: 4 bytes
onnx.checker.check_model(model_path): passes onnx.load_model(..., load_external_data=True): loads with len(raw_data) == 4
Confirmed Finding 3: nelem Overflow Not Checked in Checker
Evidence
nelem multiplication has no overflow guard:
D:\python3\Lib\site-packages\onnx\checker.cc:129-132
Reproduced Behavior
Dims: [2**32, 2**31] (product exceeds INT64_MAX)
onnx.checker.check_model(...): passes
Security Impact (Conservative)
This report demonstrates a validation integrity gap , not a direct memory corruption exploit in ONNX itself:
Malformed models can pass the official checker.
Failure is deferred to later consumers (e.g., runtime loading / reshape paths), increasing operational risk and trust in invalid artifacts.
Recommended severity: Medium (hardening / integrity of validation pipeline) .
Reproduction Command
python C:\Users\yibai7\audit\submissions\onnx\poc_onnx_bypass.pyObserved: Confirmed: 3/3.
Recommended Fixes
In check_tensor, when raw_data is present, enforce:
expected bytes from (dims, dtype) must equal raw_data.size().
For external data tensors, enforce semantic size consistency after loading metadata.
Add overflow checks when computing nelem (safe multiply with bounds).
Add regression tests for:
undersized raw_data
undersized external_data
overflowed dims product
Scope Note
No claim is made here for direct RCE from ONNX checker.
