hacnho/tensorrt-flattenconcat-deserialize-crash-poc

TensorRT FlattenConcat_TRT legacy plugin deserialization crash PoC

This repository contains a minimal proof of concept for a TensorRT native crash in legacy V1 plugin deserialization.

Summary

FlattenConcat_TRT v1 reads fields from the caller-controlled serialized_plugin buffer before checking that the buffer contains enough bytes. Calling the public Python API IPluginCreator.deserialize_plugin("poc", b"") with an empty buffer crashes the process in libnvinfer_plugin.so.11.

Tested affected packages:

• tensorrt==11.0.0.114
• tensorrt==11.1.0.106

The demonstrated impact is process-level denial of service. No code execution or data disclosure is claimed.

Reproduce

Use a clean virtual environment:

python3 -m venv /tmp/trt-poc
/tmp/trt-poc/bin/python -m pip install --upgrade pip setuptools wheel
/tmp/trt-poc/bin/python -m pip install -r requirements.txt

Run:

/tmp/trt-poc/bin/python poc_flattenconcat_empty.py

Expected result:

TensorRT version: 11.1.0.106
Calling FlattenConcat_TRT v1.deserialize_plugin with 0 bytes
Fatal Python error: Segmentation fault

The process exits with status 139.

Recorded Demo

The evidence/ directory includes:

• record-demo-output.txt - text output from record_demo.sh.
• poc.cast - asciinema recording.
• poc.svg - rendered terminal recording.
• gdb-backtrace.txt and gdb-backtrace-11.1.0.106.txt - native backtraces.
• creator-empty-payload-matrix-11.1.0.106.txt - empty-buffer results for several built-in V1 plugin creators.
• source-plugin-read-v11.0.txt, source-flattenconcat-deserialize-v11.0.txt, and source-python-binding-deserialize-v11.0.txt - source snippets from TensorRT v11.0.

Root Cause

The Python binding forwards the Python buffer pointer and length directly:

py::buffer_info info = serializedPlugin.request();
return self.deserializePlugin(name.c_str(), info.ptr, info.size * info.itemsize);

The legacy FlattenConcat constructor reads fields before checking length:

mIgnoreBatch = read<bool>(d);
mConcatAxisID = read<int32_t>(d);
...
PLUGIN_VALIDATE(d == a + length);

The shared plugin::read<T>() helper uses std::memcpy() without checking remaining bytes.

Environment

Original validation environment:

• Ubuntu 24.04.2 LTS
• Python 3.12.3
• TensorRT wheel 11.0.0.114
• TensorRT wheel 11.1.0.106

See evidence/environment.txt for the exact recorded environment.