| [*] loading malicious.onnx -> WeightsContext::convertOnnxWeights (real onnx-tensorrt path) |
| [*] initializer 'w' external_data offset is attacker-controlled and unchecked... |
| AddressSanitizer:DEADLYSIGNAL |
| ================================================================= |
| ==195392==ERROR: AddressSanitizer: SEGV on unknown address 0x7fd700763000 (pc 0x55dadf99bd45 bp 0x7ffdcad886d0 sp 0x7ffdcad88480 T0) |
| ==195392==The signal is caused by a READ memory access. |
| #0 0x55dadf99bd45 in onnx2trt::WeightsContext::convertDouble(double const*, nvinfer1::Dims64 const&) /home/kali/engagements/huntr/model-formats/tensorrt-onnx/2026-06-05/poc/../src/onnx-tensorrt/WeightsContext.cpp:60:13 |
| #1 0x55dadf9a0dd8 in onnx2trt::WeightsContext::convertOnnxWeights(onnx::TensorProto const&, onnx2trt::ShapedWeights*, bool) /home/kali/engagements/huntr/model-formats/tensorrt-onnx/2026-06-05/poc/../src/onnx-tensorrt/WeightsContext.cpp:309:23 |
| #2 0x55dadf91d228 in main /home/kali/engagements/huntr/model-formats/tensorrt-onnx/2026-06-05/poc/harness.cpp:39:19 |
| #3 0x7fd6c013bf76 (/usr/lib/x86_64-linux-gnu/libc.so.6+0x29f76) (BuildId: e0715e6b2fc508102cc2100d3d25a1aa4eb676f9) |
| #4 0x7fd6c013c026 in __libc_start_main (/usr/lib/x86_64-linux-gnu/libc.so.6+0x2a026) (BuildId: e0715e6b2fc508102cc2100d3d25a1aa4eb676f9) |
| #5 0x55dadf831e30 in _start (/home/kali/engagements/huntr/model-formats/tensorrt-onnx/2026-06-05/poc/poc_oob+0x48e30) (BuildId: 7b4d84fa2338f2234ac2c732d8ab4377d6d83631) |
|
|
| ==195392==Register values: |
| rax = 0x00007fd700763000 rbx = 0x00007ffdcad88480 rcx = 0x0000000000000000 rdx = 0xf8f8f8f8f8f8f8f8 |
| rdi = 0x00007bd6bdf022a0 rsi = 0x00007bf6bf3e0150 rbp = 0x00007ffdcad886d0 rsp = 0x00007ffdcad88480 |
| r8 = 0x0000000000000000 r9 = 0x00007fffffffff01 r10 = 0x00007fffffffff01 r11 = 0x0000000000000001 |
| r12 = 0xf8f8f2f2f2f2f8f8 r13 = 0xf8f8f2f2f2f2f2f2 r14 = 0xf8f8f8f8f8f8f2f2 r15 = 0xf2f2f2f8f8f8f8f8 |
| AddressSanitizer can not provide additional info. |
| SUMMARY: AddressSanitizer: SEGV /home/kali/engagements/huntr/model-formats/tensorrt-onnx/2026-06-05/poc/../src/onnx-tensorrt/WeightsContext.cpp:60:13 in onnx2trt::WeightsContext::convertDouble(double const*, nvinfer1::Dims64 const&) |
| ==195392==ABORTING |
|
|
