onnx-einsum-oob-poc

ONNX Einsum shape-inference OOB — crash PoC

Security-research proof-of-concept for an out-of-bounds read (CWE-125) / SIGSEGV in the ONNX Einsum operator shape-inference routine (onnx/defs/math/defs.cc, einsumShapeInference). Affects onnx <= 1.21.0 (latest).

A crafted .onnx with a malformed Einsum equation crashes the standard ONNX processing APIs onnx.shape_inference.infer_shapes() and onnx.checker.check_model(model, full_check=True). Loading alone (onnx.load) does not crash.

Files

• evil_einsum.onnx — vector 1: equation="...,...", scalar + rank-4 inputs (mutable_dim(i) OOB)
• variantB.onnx — vector 2: equation="...->z", RHS label absent from LHS (dims_value.dim() OOB)

Reproduce

pip install onnx            # 1.21.0
python -c "import onnx; onnx.shape_inference.infer_shapes(onnx.load('evil_einsum.onnx'))"
# -> Segmentation fault (core dumped)   (exit 139)

Reported via coordinated disclosure (huntr.com). Researcher: s1ko (github.com/s1ko).