lexi-core-ai/onnx-overflow-poc

ONNX Integer Overflow PoC

Vulnerability: np.prod() Integer Overflow in onnx/numpy_helper.py

Affected: onnx Python package (PyPI), all versions
File: onnx/numpy_helper.py, lines 113, 150-152

Description

numpy_helper.to_array() and the internal _unpack_4bit() / _unpack_2bit() functions use np.prod(dims) to compute tensor element counts. np.prod() on int64 arrays overflows silently for large dimensions, returning WRONG values.

Impact

1. DoS: A 128-byte ONNX file can trigger MemoryError by claiming exabyte-sized tensors
2. Data Corruption: In 4-bit/2-bit code paths, overflow causes wrong comparisons and silent data truncation
3. Wrong Size Calculations: np.prod returns 0 or small positive values instead of the correct huge product

Files

• — Full PoC with 4 test cases
• — 128-byte ONNX file with overflow dims (F32)
• — 132-byte ONNX file with overflow dims (UINT4)

Reproduction