onnxruntime crashes: Segmentation fault (core dumped) on valid model

[coffezhou]

Describe the issue

when creating the inference session on valid model, onnxruntime crashes:

Segmentation fault (core dumped)

To reproduce

Environment
OS: Ubuntu 20.04
onnxruntime: 1.23.0.dev20250517001

Steps to reproduce
This bug can be reproduced by the following code with the model in the attachment.

import onnx
import onnxruntime
            
def main():
    onnx_model = onnx.load("a397.onnx")
    onnx.checker.check_model(onnx_model, full_check=True)
    
    ort_session = onnxruntime.InferenceSession(
            onnx_model.SerializeToString(), providers=["CPUExecutionProvider"]
        )
    
if __name__ == "__main__":
    
    main()

testcase.zip

Urgency

No response

Platform

Linux

OS Version

Ubuntu 20.04

ONNX Runtime Installation

Built from Source

ONNX Runtime Version or Commit ID

1.23.0.dev20250517001

ONNX Runtime API

Python

Architecture

X64

Execution Provider

Default CPU

Execution Provider Library Version

No response

[yuslepukhin]

What is crashing is the model checker in onnx, if you comment out that line, ORT would throw an exception with the following error:

onnxruntime.capi.onnxruntime_pybind11_state.Fail: [ONNXRuntimeError] : 1 : FAIL : Node () Op (Einsum) CHECK failed: (index) < (current_size_):

This is the result of ONNX Einsum type and shape inferencing code. The version we compile with does not check for empty shape.
It is a bug which will be addressed.

It looks like, in your model reducemax_output is inferred to be a scalar which is not handled correctly (whether it is valid or not).

Filed issue with ONNX onnx/onnx#6981