ReLrO/tensorrt-oob-deserialize-poc

TensorRT Plugin Deserialization OOB Read PoC

Vulnerability

Out-of-bounds memory access in TensorRT plugin deserialization due to:

1. read<T>() in plugin.h:100-108 — Zero bounds checking on the primary deserialization primitive used by 30+ plugins
2. serialize.hpp assert-only checks — assert() is compiled out in release builds (NDEBUG), leaving zero bounds checking in production

Files

• poc_tensorrt_serialize.cpp — Standalone PoC extracting vulnerable code from TensorRT source

Reproduction

# Build in release mode (NDEBUG — matching production TensorRT):
g++ -fsanitize=address -g -DNDEBUG -std=c++17 -o poc_release poc_tensorrt_serialize.cpp

# Run:
./poc_release

Expected ASAN Output

==PID==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x...
READ of size 4 at 0x... thread T0
    #0 in int read<int, char>(char const*&) poc_tensorrt_serialize.cpp:171
    #1 in poc_read_oob() poc_tensorrt_serialize.cpp:213

Tested On

TensorRT latest commit from default branch (2026-02-27)