| --- |
| license: other |
| tags: |
| - security |
| - fuzzing |
| - onnx |
| - null-pointer-dereference |
| - denial-of-service |
| --- |
| |
| # ONNX core parser: NULL-pointer dereference in FunctionProto shape inference (DoS) |
|
|
| **Status:** gated PoC, access restricted for coordinated disclosure via huntr.com (Model File |
| Vulnerability program). Contact protectai-bot / huntr maintainers for access. |
|
|
| ## Summary |
|
|
| `onnx/onnx` (the core protobuf model parser/checker library that ships with every |
| `pip install onnx`, and that ONNX Runtime, model-surgery tools, and MLOps pipelines call |
| directly on **untrusted, externally-sourced** `.onnx` files) crashes with a NULL-pointer |
| dereference (SIGSEGV) when shape inference is run over a model-local `FunctionProto` whose |
| call site omits a trailing optional input, **if that same (unbound) formal parameter name is |
| also used as one of the function's own output names**. |
|
|
| This is reachable via: |
| - `onnx.checker.check_model(model, full_check=True)` — the officially documented, commonly |
| recommended way to fully validate an untrusted ONNX model before use. |
| - `onnx.shape_inference.infer_shapes(model)` — used directly by many downstream tools |
| (ONNX Runtime tooling, `onnx-graphsurgeon`, model optimizers/converters, MLOps ingestion |
| pipelines) to propagate shapes over third-party models. |
|
|
| Both entry points crash the host **Python process itself** (native SIGSEGV, not a catchable |
| Python exception) on a **159-byte** crafted `.onnx` file — i.e. any service that loads and |
| validates/shape-infers an attacker-supplied ONNX file goes down. |
|
|
| ## Root cause |
|
|
| `onnx/shape_inference/implementation.cc`, `ShapeInferenceImplBase::Process(const FunctionProto&, InferenceContext&)`: |
|
|
| ```cpp |
| for (int i = 0; i < num_func_inputs; ++i) { |
| const auto& parameter_name = func_proto.input().Get(i); |
| const auto* const type_ptr = (i < num_actual_inputs) ? ctx.getInputType(i) : nullptr; |
| // nullptr is valid, and indicates a missing optional input |
| if (type_ptr != nullptr) { |
| types_cache[i] = *type_ptr; |
| value_types_by_name[parameter_name] = &types_cache[i]; |
| } else { |
| value_types_by_name[parameter_name] = nullptr; // <-- intentional null, by design |
| } |
| } |
| ``` |
|
|
| When a function call site provides fewer actual inputs than the function's formal parameter |
| list (a legal, documented way to pass "missing optional inputs" to a function), the missing |
| parameter's name is registered in `value_types_by_name` with an explicit `nullptr` value. |
| This is intentional and, by itself, correct. |
|
|
| The bug is that two *consumers* of `value_types_by_name` later dereference that stored |
| pointer **without checking it for null**, whenever the same name is looked up again: |
|
|
| 1. `ShapeInferenceImplBase::UpdateType()` (line ~367) → `mergeShapesAndTypes(*inferred_type, iter->second)` |
| → `checkShapesAndTypes(inferred_type, *existing_type)` (line 198, 112) dereferences |
| `existing_type` directly → `TypeProto::value_case()` on a null `this` → SEGV. |
| Triggered when any node *inside* the function body reuses the missing parameter's name as |
| its own output name (so `UpdateType` is invoked again for that name). |
|
|
| 2. `ShapeInferenceImplBase::Process(const FunctionProto&, InferenceContext&)` (line 670), |
| the function-output copy-back loop: |
| ```cpp |
| for (int i = 0; i < func_proto.output_size(); ++i) { |
| auto iter = value_types_by_name.find(output_name); |
| if (iter != value_types_by_name.cend()) { |
| ctx.getOutputType(i)->CopyFrom(*(iter->second)); // <-- null deref if iter->second==nullptr |
| } |
| } |
| ``` |
| Triggered directly when the function declares the missing parameter's name as one of its |
| own **outputs** (a pure pass-through, no processing node required at all — this is the |
| PoC below). |
|
|
| Both are two call sites of the **same** underlying oversight (introduced in |
| [onnx/onnx#5066](https://github.com/onnx/onnx/pull/5066), merged April 2023, "Fix an issue |
| in function type/shape inference to support optional inputs" — the fix added the |
| intentional-null storage but never audited/guarded its later readers). The bug has been |
| present, unfixed, for 3+ years and reproduces on current `main` |
| (`964b886d46d337fa775c6e4012a90534b28cd3ca`, 2026-07-07). |
|
|
| ## PoC |
|
|
| `poc_minimal.onnx` (159 bytes) — built with `make_min_poc.py` (included) using the standard |
| `onnx.helper` API: |
|
|
| - One model-local function `custom.domain::PassThroughY`, formal inputs `["x", "y"]`, |
| formal outputs `["y"]`, **zero nodes** in its body (pure name pass-through). |
| - One call node in the main graph invokes it with only **one** actual input (`["fx"]`), |
| leaving formal parameter `"y"` unbound. |
|
|
| ```python |
| import onnx |
| m = onnx.load("poc_minimal.onnx") |
| onnx.checker.check_model(m, full_check=True) # SIGSEGV |
| # or: |
| onnx.shape_inference.infer_shapes(m) # SIGSEGV |
| ``` |
|
|
| Reproduces on a stock `pip install onnx` (tested against onnx 1.22.0, PyPI wheel, no custom |
| build) — see `repro_pip_onnx.txt`. |
|
|
| ## ASan stack trace (from-source ASan+AFL build of onnx/onnx main, matching line numbers) |
|
|
| See `asan_trace.txt`. Top of stack: |
|
|
| ``` |
| AddressSanitizer: SEGV on unknown address 0x000000000010 |
| #0 onnx::TypeProto::MergeImpl(...) onnx-ml.pb.cc:11593 |
| #1 ShapeInferenceImplBase::Process(FunctionProto const&, InferenceContext&) implementation.cc:670 |
| #2 InferShapeForFunctionNodeInternal(...) implementation.cc:879 |
| #3 ShapeInferenceImplBase::ProcessCall(...) implementation.cc:896 |
| #4 ShapeInferenceImplBase::Process(NodeProto&) implementation.cc:489 |
| #5 ShapeInferenceImplBase::Process(GraphProto&) implementation.cc:599 |
| #6 InferShapesImpl(...) implementation.cc:789 |
| #7 onnx::shape_inference::InferShapes(ModelProto&, ...) implementation.cc:824 |
| #8 onnx::checker::check_model(ModelProto const&, ...) checker.cc:1187 |
| ``` |
|
|
| ## How this was found |
|
|
| Coverage-guided AFL++ fuzzing (`afl-clang-fast++` + `AFL_USE_ASAN=1`) directly against the |
| unmodified onnx/onnx C++ core (`checker::check_model` + `shape_inference::InferShapes`), |
| built from source against a matching protobuf 6.31.1/v31.1 (Abseil-backed) static build, and |
| seeded with a small hand-written corpus of structurally valid ONNX models covering Add/Conv/ |
| If/Loop/local-function/Sequence graphs. AFL found 13 raw crashing inputs across a |
| ~25-minute, single-machine (4-core) campaign; all 13 were manually triaged by true root |
| cause (not just distinct stack hashes) down to **one** underlying bug at two call sites, and |
| then hand-minimized to the 159-byte PoC above (no nodes, no tensors, no shapes — just the |
| function-signature/call-arity mismatch that triggers the null store). |
|
|
| ## Dedup / prior-art check |
|
|
| - Github-issue-searched onnx/onnx for prior reports referencing `checkShapesAndTypes`, |
| `mergeShapesAndTypes`, `value_types_by_name`, `ProcessCall`, |
| `InferShapeForFunctionNodeInternal`, and "function optional input segfault" — no matching |
| open or closed issue found. |
| - Confirmed distinct from the closest-sounding prior reports: onnx/onnx#5219 (closed; a |
| *different* function — the `shape` **data-propagation** helper, not general |
| type/shape-inference merge), #5989 (schema-level empty input/output mismatch, not |
| function-call arity), #5212 (segfault specific to `data_prop=True` on nested functions). |
| - The introducing PR (#5066, April 2023) is old and merged; the bug has had 3+ years of |
| exposure (including onnx/onnx's own OSS-Fuzz atheris harnesses, live since ~mid-June 2026) |
| without being caught, most likely because triggering it requires a specific, non-trivial |
| `FunctionProto`/optional-input/name-reuse structure that raw-byte-mutation fuzzing rarely |
| reaches without a domain-aware seed — exactly the gap a seeded, coverage-guided native |
| build closes. |
|
|
| ## Impact |
|
|
| Any process that runs `onnx.checker.check_model(untrusted_model, full_check=True)` or |
| `onnx.shape_inference.infer_shapes(untrusted_model)` over a file it does not fully trust — |
| model marketplaces, CI/CD model-validation gates, MLOps ingestion services, ONNX converters |
| — can be crashed (denial of service) by a 159-byte file with no special privileges. This is |
| a native SIGSEGV, not a Python exception, so it cannot be caught by a `try/except` around the |
| call; it takes down the whole process (and, in naive multi-tenant setups, everything else |
| running in it). |
|
|
