# onnx-tensorrt — OOB read via unvalidated external_data `offset` (CWE-125)

Loading `malicious.onnx` with **onnx-tensorrt** (NVIDIA's TensorRT ONNX parser; also bundled in NVIDIA/TensorRT)
triggers an out-of-bounds read while importing the model's weights.

## Root cause
`onnx-tensorrt/WeightsContext.cpp`, `parseExternalWeights()`: the `offset` from a TensorProto's
`external_data` map is used directly as `weightsPtr = mmap_base + offset` with **no bounds check against the
mapped file size** (only `length` is validated, against the tensor's dims). `convertOnnxWeights()` then reads
the weights at `mmap_base + offset` (for `DOUBLE` tensors, via `convertDouble()` at parse time).
`offset` is fully attacker-controlled (a decimal string parsed with `atoll`), so the read address is attacker-controlled.

## Files
- `poc.zip` — contains `malicious.onnx` (the model) + `w.bin`; unzip before running. The ONNX model whose single initializer `w` uses `external_data` with `offset=1073741824` (1 GiB), `dtype=DOUBLE`, `dims=[8]`
- `w.bin` — the (valid, 64-byte) external weights file it references
- `harness.cpp` / `stubs.cpp` / `build.sh` — a GPU-free ASAN harness that runs the real onnx-tensorrt weight-import path on `malicious.onnx`
- `PROOF.txt` — the AddressSanitizer report

## Reproduce (GPU-free, ~minutes)
1. `git clone https://github.com/onnx/onnx-tensorrt && git clone https://github.com/NVIDIA/TensorRT` (for `include/` headers)
2. Get protobuf without sudo: `apt-get download protobuf-compiler libprotobuf-dev libprotobuf32t64 && for d in *.deb; do dpkg-deb -x "$d" localroot; done`
3. Copy `onnx-ml.proto` (from the `onnx` pip package) into `onnx/`, then run `build.sh`.
4. `unzip poc.zip && ./poc_oob malicious.onnx`  →  `AddressSanitizer: SEGV on ... READ` in `convertDouble` at `mmap_base + 0x40000000` (== the 1 GiB offset).

Alternatively, on a machine with TensorRT + a GPU: `trtexec --onnx=malicious.onnx` reaches the same import path.

## Fix
In `parseExternalWeights`, validate `offset` (and `offset + length`) against the mapped file size before
`weightsPtr = mmap_base + offset`; reject negative/out-of-range offsets.

## Not a duplicate of the known ONNX external_data CVEs
This bug is in **NVIDIA's `onnx-tensorrt` parser** (`WeightsContext.cpp`), a different codebase from the `onnx`
Python/C++ library. The publicly known ONNX external_data issues are **path traversal**:
- CVE-2022-25882 — onnx `<1.13` external_data path outside model dir
- CVE-2026-27489 — onnx `<1.21` external_data symlink escape

`onnx-tensorrt` already guards `../` path traversal. This report is a **different bug class** — an unvalidated
numeric **`offset`** (not a path) added to the mmap base → out-of-bounds **read**. No CVE/GHSA/OSV or prior huntr
report covers the onnx-tensorrt `offset` gap.

## Severity
CVSS 3.1 `AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H` = 6.5 (Medium) for the demonstrated crash/DoS; the attacker-controlled
read address gives information-disclosure potential that could raise it.