| # TensorRT / onnx-tensorrt PoC: Loop body input OOB (crash) | |
| This repo contains a small malformed ONNX model that triggers a deterministic crash in **onnx-tensorrt**'s `Loop` importer. | |
| ## Summary | |
| The ONNX `Loop` operator has a `body` subgraph. | |
| `onnx-tensorrt` assumes that the number of inputs in the loop body subgraph is **at least** the number of inputs on the outer `Loop` node. | |
| If a malicious ONNX model provides a `Loop` node with **3 inputs** (trip-count, condition, state0) but the `body` graph contains only **2 inputs**, the parser indexes `body.input(2)` out-of-bounds while mapping state variables. | |
| ## Files | |
| - `poc_loop_body_input_oob.onnx` – malformed ONNX model | |
| - `make_poc_loop_body_input_oob.py` – generator script (does not require the `onnx` pip package) | |
| - `gen/onnx_pb2.py` – protobuf bindings generated from `onnx.proto` | |
| ## Reproduction (typical TensorRT install) | |
| ### Using `trtexec` | |
| ```bash | |
| trtexec --onnx=poc_loop_body_input_oob.onnx --verbose | |
| ``` | |
| Expected result: **process crash / abort** during ONNX parse or network build. | |
| ### Using the C++ API | |
| Any code path that calls the TensorRT ONNX parser on this model should reproduce, e.g. `nvonnxparser::IParser::parseFromFile()`. | |
| ## Regenerating the model | |
| ```bash | |
| # Requires: python3 + protobuf runtime, and a generated onnx_pb2 (already included in gen/) | |
| python3 make_poc_loop_body_input_oob.py poc_loop_body_input_oob.onnx | |
| ``` | |