Downloads · 30 days
0
torch-t7-importer-integer-validation-poc-DO-NOT-USE
drogba771/torch-t7-importer-integer-validation-poc-DO-NOT-USE
torch-t7-importer-integer-validation-poc-DO-NOT-USE is a machine learning model from drogba771. Use it for the machine learning task on the model card, and read the license before you ship it in a product.
This repository contains malformed/crafted Torch7 (.t7) model files that trigger memory-safety crashes in OpenCV's Torch importer (modules/dnn/src/torch/torchimporter.cpp). These are passive data files, not executable…
Access
Public
Updated Jul 18, 2026
Repo size
205 KB
Likes
1
Public
Repo makeup
Click a slice to open those files.
.t7205 KB · 94%
At a glance
- Access
- Public
- Created
- Jul 18, 2026
- Updated
- Jul 18, 2026
- SHA
- c8290526
Model card
From the Hugging Face model README
WARNING: SECURITY RESEARCH - PROOF OF CONCEPT ONLY
This repository contains malformed/crafted Torch7 (.t7) model files that trigger memory-safety crashes in OpenCV's Torch importer (modules/dnn/src/torch/torch_importer.cpp). These are passive data files, not executable code - they do nothing on their own and only cause a crash when parsed by cv::dnn::readNetFromTorch().
DO NOT load these files with a production OpenCV build outside of an isolated, disposable research environment.
Findings Summary
| File | Finding | CWE | Confirmation | Location |
|---|---|---|---|---|
| kernel_zero_fpe_poc.t7 | Division by zero (kernel_h/kernel_w=0) | CWE-369 | Fuzz-confirmed | torch_importer.cpp:556 |
| storage_size_overflow_poc.t7 | Integer truncation -> heap OOB | CWE-190/CWE-122 | Fuzz-confirmed | torch_importer.cpp:258-261 |
Reproduction
Build OpenCV's dnn module with AddressSanitizer enabled, then call cv::dnn::readNetFromTorch() on each file. Both pass initial parsing but trigger an ASan-detected crash at the locations listed above.
Full vulnerability report: see report.md in this repository.
- Created
- Jul 18, 2026
- Updated
- Jul 18, 2026