dxoth1nh/onnxruntime-local-function-chain-load-segfault

ONNX Runtime Local Function Chain Load Segfault

Defensive validation / triage only. This repository contains a harmless reproduction artifact for bounded local load-time denial of service.

A crafted ONNX model can define an acyclic chain of model-local functions that exceeds ONNX Runtime's load-path hardening. Current testing shows that onnxruntime.InferenceSession(...) on a roughly 175 KB artifact can recurse until the process exits with SIGSEGV during normal session creation.

Files

• model/onnx-local-function-depth-dos.onnx: crafted crash artifact
• model/small-control.onnx: shallow control artifact
• generator/build_local_function_chain_load_segfault.py: deterministic internal builder
• reproduce/replay_local_function_chain_load.py: isolated replay harness with JSON output
• build-meta.json: pinned measurements and artifact metadata

Differential

• Control: depth=100, accepted by onnx.checker, loads normally in ONNX Runtime
• Crafted: depth=3000, rejected by onnx.checker depth guard but still accepted by ONNX Runtime's load path and crashes the process
• Observed on Ubuntu 24.04 x86_64:
  • onnxruntime 1.26.0: crafted session creation exits with SIGSEGV
  • onnxruntime 1.27.0: crafted session creation exits with SIGSEGV

Quick Repro

/home/chopp3r/mfv-hunts/onnx_20260717/.venv/bin/python \
  /home/chopp3r/mfv-hunts/onnx_20260717/poc/onnxruntime-local-function-chain-load-segfault/reproduce/replay_local_function_chain_load.py \
  --crafted-path /home/chopp3r/mfv-hunts/onnx_20260717/poc/onnxruntime-local-function-chain-load-segfault/model/onnx-local-function-depth-dos.onnx \
  --control-path /home/chopp3r/mfv-hunts/onnx_20260717/poc/onnxruntime-local-function-chain-load-segfault/model/small-control.onnx \
  --python-bin /home/chopp3r/mfv-hunts/onnx_20260717/.venv/bin/python \
  --mode default \
  --repeats 1

Notes

• Harmless proof only: the effect is bounded local process termination and severe load-time slowdown before the crash threshold.
• No victim source modifications are required.
• The root cause is distinct from sparse initializer densification: this primitive abuses recursive local-function shape inference and missing depth parity with onnx.checker.