onnx: fix checker.cc build on toolchains without std::filesystem

Author: aninda-al

SPECS/pytorch/CVE-2026-34446.patch

@@ -1,31 +1,36 @@
-From 3667d980becce3b499b5e2fee4a3d94694fb7d3a Mon Sep 17 00:00:00 2001
-From: AllSpark <allspark@microsoft.com>
-Date: Thu, 9 Apr 2026 09:28:45 +0000
-Subject: [PATCH] Backport security improvements for ONNX external data
- handling: canonical containment, symlink rejection, O_NOFOLLOW usage, and
- hardlink checks in C++ and Python paths; update tests accordingly.
+From cd7dfb063086cf64b14a0e421bce2b42a5bdb94b Mon Sep 17 00:00:00 2001
+From: Aninda <v-anipradhan@microsoft.com>
+Date: Sun, 12 Apr 2026 17:20:17 -0400
+Subject: [PATCH] Address CVE-2026-34446
 
-Upstream-reference: https://github.com/onnx/onnx/commit/4755f8053928dce18a61db8fec71b69c74f786cb.patch
-
-Note: The original patch authored by AllSpark was backported by Aninda <v-anipradhan@microsoft.com> to apply to version 2.0.0 of PyTorch on Azure Linux.
 ---
- third_party/onnx/onnx/checker.cc              | 41 ++++++++++
+ third_party/onnx/onnx/checker.cc              | 51 ++++++++++++
  third_party/onnx/onnx/external_data_helper.py | 81 ++++++++++++++++++-
- 2 files changed, 121 insertions(+), 1 deletion(-)
+ 2 files changed, 131 insertions(+), 1 deletion(-)
 
 diff --git a/third_party/onnx/onnx/checker.cc b/third_party/onnx/onnx/checker.cc
-index 38a068dd..13eedf3c 100644
+index 38a068dd..6cd54397 100644
 --- a/third_party/onnx/onnx/checker.cc
 +++ b/third_party/onnx/onnx/checker.cc
-@@ -20,6 +20,7 @@
+@@ -20,6 +20,17 @@
 
  #else // POSIX
  #include <sys/stat.h>
-+#include <filesystem>
++
++#if __has_include(<filesystem>) && defined(__cpp_lib_filesystem)
++  #include <filesystem>
++  namespace fs = std::filesystem;
++#elif __has_include(<experimental/filesystem>)
++  #include <experimental/filesystem>
++  namespace fs = std::experimental::filesystem;
++#else
++  #error "No filesystem support available"
++#endif
++
  #endif
 
  namespace ONNX_NAMESPACE {
-@@ -1012,7 +1013,47 @@ std::string resolve_external_data_location(
+@@ -1012,7 +1023,47 @@ std::string resolve_external_data_location(
          location,
          "' points outside the directory");
    }
@@ -36,7 +41,7 @@ index 38a068dd..13eedf3c 100644
    std::string data_path = path_join(base_dir, relative_path);
 +  if (!data_path.empty() && data_path[0] != '#') {
 +    std::error_code ec;
-+    auto canonical_base = std::filesystem::weakly_canonical(std::filesystem::path(base_dir), ec);
++    auto canonical_base = fs::canonical(fs::path(base_dir), ec);
 +    if (ec) {
 +      fail_check(
 +          "Data of TensorProto ( tensor name: ",
@@ -45,7 +50,7 @@ index 38a068dd..13eedf3c 100644
 +          location,
 +          ", but the model directory path could not be resolved.");
 +    }
-+    auto canonical_data = std::filesystem::weakly_canonical(std::filesystem::path(data_path), ec);
++    auto canonical_data = fs::canonical(fs::path(data_path), ec);
 +    if (ec) {
 +      fail_check(
 +          "Data of TensorProto ( tensor name: ",
@@ -56,8 +61,8 @@ index 38a068dd..13eedf3c 100644
 +    }
 +    auto canonical_base_native = canonical_base.native();
 +    auto canonical_data_native = canonical_data.native();
-+    if (!canonical_base_native.empty() && canonical_base_native.back() != std::filesystem::path::preferred_separator) {
-+      canonical_base_native += std::filesystem::path::preferred_separator;
++    if (!canonical_base_native.empty() && canonical_base_native.back() != fs::path::preferred_separator) {
++      canonical_base_native += fs::path::preferred_separator;
 +    }
 +    if (canonical_data_native.find(canonical_base_native) != 0) {
 +      fail_check(

SPECS/pytorch/pytorch.spec

@@ -79,6 +79,13 @@ You can reuse your favorite Python packages such as NumPy, SciPy and Cython to e
 export MAX_JOBS=8
 export USE_CUDA=0
 export BUILD_CAFFE2=0
+# The following flags are required to fix build failure due to missing std::filesystem symbols in gcc 9 and 10.
+export CXXFLAGS="%{optflags} -std=gnu++17"
+export LDFLAGS="$LDFLAGS -lstdc++fs"
+export CMAKE_EXE_LINKER_FLAGS="$CMAKE_EXE_LINKER_FLAGS -lstdc++fs"
+export CMAKE_SHARED_LINKER_FLAGS="$CMAKE_SHARED_LINKER_FLAGS -lstdc++fs"
+export CMAKE_MODULE_LINKER_FLAGS="$CMAKE_MODULE_LINKER_FLAGS -lstdc++fs"
+
 %py3_build
 
 %install