README-3.md

# PoC: Unbounded Allocation DoS in Tensorizer Header Parsing

**Affected:** `tensorizer` (PyPI) v2.12.1
**Vulnerability class:** CWE-789 (Memory Allocation with Excessive Size Value)

## What this repo contains

`tensorizer_poc.py` — a standalone script that reproduces the exact
vulnerable code from `_TensorHeaderDeserializer.from_io()` in the real
`tensorizer/serialization.py` (cited verbatim, with line references, in
the accompanying full report), without requiring `tensorizer`'s full
dependency stack (torch, boto3, redis) to be installed.

## How to reproduce

```bash
python3 tensorizer_poc.py all
```

**Observed result (verified on a 3.9GB RAM Linux host, Python 3.12.3):**

```
=== Mode: cpu_cost (claimed_len = 1 GB) ===
  header claims 1,000,000,000 bytes (1.00 GB) — about to allocate, no validation...
  allocation SUCCEEDED in 4.2338s (from an 8-byte malicious input)

=== Mode: memory_error (claimed_len = 100 GB) ===
  header claims 100,000,000,000 bytes (100.00 GB) — about to allocate, no validation...
  MemoryError raised (uncaught in the real library's call site): MemoryError()

=== Mode: overflow_error (claimed_len = 2**63) ===
  header claims 9,223,372,036,854,775,808 bytes — about to allocate, no validation...
  OverflowError raised — a DIFFERENT exception type than MemoryError:
  OverflowError("cannot fit 'int' into an index-sized integer")
```

## Why this matters

`tensorizer` loads tensor data from local files **and from network
sources** — HTTP/HTTPS, S3, and Redis. A single 8-byte malicious value at
the start of any tensor entry, from any of these sources, either:
- forces multiple seconds of CPU time from a tiny input (amplification
  DoS), or
- raises an exception that is not caught anywhere in the real
  deserialization call path, terminating the calling operation.

Neither requires more than 8 bytes of attacker-controlled data. Full
write-up, exact source citations, and suggested remediation are in the
accompanying disclosure report.