hacnho/onnx-function-output-mismatch-abort-poc

ONNX FunctionProto output-underbinding abort PoC

This repository hosts a benign security research proof-of-concept for an ONNX model file vulnerability affecting ONNX Runtime local-function loading.

Files:

• control-function-single-output.onnx
• malicious-function-output-mismatch.onnx
• build_poc.py
• repro.py

Reproduction:

python3 repro.py

Expected results:

• control-function-single-output.onnx
  • checker passes
  • shape inference passes
  • InferenceSession(...) succeeds
  • sess.run(...) returns [1.0]
• malicious-function-output-mismatch.onnx
  • checker passes
  • shape inference reports Output 1 is out of bounds
  • InferenceSession(...) aborts with SIGABRT