PoC: Unbounded Allocation DoS in Tensorizer Header Parsing

Affected: tensorizer (PyPI) v2.12.1 Vulnerability class: CWE-789 (Memory Allocation with Excessive Size Value)

What this repo contains

tensorizer_poc.py — a standalone script that reproduces the exact vulnerable code from _TensorHeaderDeserializer.from_io() in the real tensorizer/serialization.py (cited verbatim, with line references, in the accompanying full report), without requiring tensorizer's full dependency stack (torch, boto3, redis) to be installed.

How to reproduce

python3 tensorizer_poc.py all

Observed result (verified on a 3.9GB RAM Linux host, Python 3.12.3):

=== Mode: cpu_cost (claimed_len = 1 GB) ===
  header claims 1,000,000,000 bytes (1.00 GB) — about to allocate, no validation...
  allocation SUCCEEDED in 4.2338s (from an 8-byte malicious input)

=== Mode: memory_error (claimed_len = 100 GB) ===
  header claims 100,000,000,000 bytes (100.00 GB) — about to allocate, no validation...
  MemoryError raised (uncaught in the real library's call site): MemoryError()

=== Mode: overflow_error (claimed_len = 2**63) ===
  header claims 9,223,372,036,854,775,808 bytes — about to allocate, no validation...
  OverflowError raised — a DIFFERENT exception type than MemoryError:
  OverflowError("cannot fit 'int' into an index-sized integer")

Why this matters

tensorizer loads tensor data from local files and from network sources — HTTP/HTTPS, S3, and Redis. A single 8-byte malicious value at the start of any tensor entry, from any of these sources, either:

forces multiple seconds of CPU time from a tiny input (amplification DoS), or
raises an exception that is not caught anywhere in the real deserialization call path, terminating the calling operation.

Neither requires more than 8 bytes of attacker-controlled data. Full write-up, exact source citations, and suggested remediation are in the accompanying disclosure report.