Added missing CVE-2026-34446.patch file

Author: aninda-al

SPECS/pytorch/CVE-2026-34446.patch

@@ -0,0 +1,191 @@
+From 3667d980becce3b499b5e2fee4a3d94694fb7d3a Mon Sep 17 00:00:00 2001
+From: AllSpark <allspark@microsoft.com>
+Date: Thu, 9 Apr 2026 09:28:45 +0000
+Subject: [PATCH] Backport security improvements for ONNX external data
+ handling: canonical containment, symlink rejection, O_NOFOLLOW usage, and
+ hardlink checks in C++ and Python paths; update tests accordingly.
+
+Upstream-reference: https://github.com/onnx/onnx/commit/4755f8053928dce18a61db8fec71b69c74f786cb.patch
+
+Note: The original patch authored by AllSpark was backported by Aninda <v-anipradhan@microsoft.com> to apply to version 2.0.0 of PyTorch on Azure Linux.
+---
+ third_party/onnx/onnx/checker.cc              | 41 ++++++++++
+ third_party/onnx/onnx/external_data_helper.py | 81 ++++++++++++++++++-
+ 2 files changed, 121 insertions(+), 1 deletion(-)
+
+diff --git a/third_party/onnx/onnx/checker.cc b/third_party/onnx/onnx/checker.cc
+index 38a068dd..13eedf3c 100644
+--- a/third_party/onnx/onnx/checker.cc
++++ b/third_party/onnx/onnx/checker.cc
+@@ -20,6 +20,7 @@
+ 
+ #else // POSIX
+ #include <sys/stat.h>
++#include <filesystem>
+ #endif
+ 
+ namespace ONNX_NAMESPACE {
+@@ -1012,7 +1013,47 @@ std::string resolve_external_data_location(
+         location,
+         "' points outside the directory");
+   }
++  // Verify the resolved path stays within the base directory to prevent
++  // path traversal via symlinks in parent directory components.
++  // is_symlink() only checks the final component; a path like
++  // "symlink_subdir/real_file.data" would bypass it.
+   std::string data_path = path_join(base_dir, relative_path);
++  if (!data_path.empty() && data_path[0] != '#') {
++    std::error_code ec;
++    auto canonical_base = std::filesystem::weakly_canonical(std::filesystem::path(base_dir), ec);
++    if (ec) {
++      fail_check(
++          "Data of TensorProto ( tensor name: ",
++          tensor_name,
++          ") references external data at ",
++          location,
++          ", but the model directory path could not be resolved.");
++    }
++    auto canonical_data = std::filesystem::weakly_canonical(std::filesystem::path(data_path), ec);
++    if (ec) {
++      fail_check(
++          "Data of TensorProto ( tensor name: ",
++          tensor_name,
++          ") references external data at ",
++          location,
++          ", but the data path could not be resolved.");
++    }
++    auto canonical_base_native = canonical_base.native();
++    auto canonical_data_native = canonical_data.native();
++    if (!canonical_base_native.empty() && canonical_base_native.back() != std::filesystem::path::preferred_separator) {
++      canonical_base_native += std::filesystem::path::preferred_separator;
++    }
++    if (canonical_data_native.find(canonical_base_native) != 0) {
++      fail_check(
++          "Data of TensorProto ( tensor name: ",
++          tensor_name,
++          ") at ",
++          location,
++          " resolves to a location outside the model directory, "
++          "indicating a potential path traversal attack via symbolic links in directory components.");
++    }
++  }
++
+   // use stat64 to check whether the file exists
+ #if defined(__APPLE__) || defined(__wasm__) || !defined(__GLIBC__)
+   struct stat buffer; // APPLE, wasm and non-glic stdlibs do not have stat64
+diff --git a/third_party/onnx/onnx/external_data_helper.py b/third_party/onnx/onnx/external_data_helper.py
+index 27a0a407..31257782 100644
+--- a/third_party/onnx/onnx/external_data_helper.py
++++ b/third_party/onnx/onnx/external_data_helper.py
+@@ -8,6 +8,7 @@ from itertools import chain
+ from typing import Callable, Iterable, Optional, IO
+  
+ import onnx.onnx_cpp2py_export.checker as c_checker
++import onnx.checker as onnx_checker
+ from .onnx_pb import AttributeProto, GraphProto, ModelProto, TensorProto
+ 
+ # Security: 3-layer defense against malicious external_data entries (GHSA-538c-55jv-c5g9)
+@@ -121,6 +122,73 @@ def load_external_data_for_tensor(tensor: TensorProto, base_dir: str) -> None:
+         tensor: a TensorProto object.
+         base_dir: directory that contains the external data.
+     """
++    info = ExternalDataInfo(tensor)
++    external_data_file_path = c_checker._resolve_external_data_location(  # type: ignore[attr-defined]
++        base_dir, info.location, tensor.name
++    )
++    # Security checks (symlink, containment, hardlink) already performed
++    # by C++ _resolve_external_data_location() above.
++    # Use O_NOFOLLOW where available as defense-in-depth for symlink protection
++    open_flags = os.O_RDONLY
++    if hasattr(os, "O_NOFOLLOW"):
++        open_flags |= os.O_NOFOLLOW
++    fd = os.open(external_data_file_path, open_flags)
++    with os.fdopen(fd, "rb") as data_file:
++        if info.offset:
++            data_file.seek(info.offset)
++
++        if info.length:
++            tensor.raw_data = data_file.read(info.length)
++        else:
++            tensor.raw_data = data_file.read()
++
++
++def _validate_external_data_path(
++    base_dir: str,
++    data_path: str,
++    tensor_name: str,
++    *,
++    check_exists: bool = True,
++) -> str:
++    """Validate that an external data path is safe to open.
++
++    Performs three security checks:
++    1. Canonical path containment — resolved path must stay within base_dir.
++    2. Symlink rejection — final-component symlinks are not allowed.
++    3. Hardlink count — files with multiple hard links are rejected.
++
++    Args:
++        base_dir: The model base directory that data_path must be contained in.
++        data_path: The external data file path to validate.
++        tensor_name: Tensor name for error messages.
++        check_exists: If True (default), check hardlink count. Set to False
++            for save-side paths where the file may not exist yet.
++
++    Returns:
++        The validated data_path (unchanged).
++
++    Raises:
++        onnx.checker.ValidationError: If any security check fails.
++    """
++    real_base = os.path.realpath(base_dir)
++    real_path = os.path.realpath(data_path)
++    if not real_path.startswith(real_base + os.sep) and real_path != real_base:
++        raise onnx_checker.ValidationError(
++            f"Tensor {tensor_name!r} external data path resolves to "
++            f"{real_path!r} which is outside the model directory {real_base!r}."
++        )
++    if os.path.islink(data_path):
++        raise onnx_checker.ValidationError(
++            f"Tensor {tensor_name!r} external data path {data_path!r} "
++            f"is a symbolic link, which is not allowed for security reasons."
++        )
++    if check_exists and os.path.exists(data_path) and os.stat(data_path).st_nlink > 1:
++        raise onnx_checker.ValidationError(
++            f"Tensor {tensor_name!r} external data path {data_path!r} "
++            f"has multiple hard links, which is not allowed for security reasons."
++        )
++    return data_path
++
+     info = ExternalDataInfo(tensor)
+     external_data_file_path = c_checker._resolve_external_data_location(  # type: ignore[attr-defined]
+         base_dir, info.location, tensor.name
+@@ -254,6 +322,12 @@ def save_external_data(tensor: TensorProto, base_path: str) -> None:
+     info = ExternalDataInfo(tensor)
+     external_data_file_path = os.path.join(base_path, info.location)
+ 
++    # C++ _resolve_external_data_location() cannot be used on save path
++    # (file may not exist yet), so Python performs its own security validation.
++    _validate_external_data_path(
++        base_path, external_data_file_path, tensor.name, check_exists=True
++    )
++
+     # Retrieve the tensor's data from raw_data or load external file
+     if not tensor.HasField("raw_data"):
+         raise ValueError("raw_data field doesn't exist.")
+@@ -263,7 +337,12 @@ def save_external_data(tensor: TensorProto, base_path: str) -> None:
+         open(external_data_file_path, "ab").close()
+ 
+     # Open file for reading and writing at random locations ('r+b')
+-    with open(external_data_file_path, "r+b") as data_file:
++    # Use O_NOFOLLOW for symlink protection when opening
++    open_flags = os.O_RDWR
++    if hasattr(os, "O_NOFOLLOW"):
++        open_flags |= os.O_NOFOLLOW
++    fd = os.open(external_data_file_path, open_flags)
++    with os.fdopen(fd, "r+b") as data_file:
+         data_file.seek(0, 2)
+         if info.offset is not None:
+             # Pad file to required offset if needed
+-- 
+2.34.1
+