Ollama GGUF Parser Integer Overflow PoC
Proof-of-concept for multiple integer handling vulnerabilities in Ollama's Go GGUF parser.
Vulnerabilities
Bug 1: CWE-681 - readGGUFString uint64-to-int Negative Conversion
File: fs/ggml/gguf.go line 359, fs/gguf/gguf.go readString()
String length values >= 2^63 are read as uint64, then converted to int via int(uint64_val). On 64-bit systems this produces a negative integer. The negative value bypasses the bounds check (length > len(scratch) evaluates to false for negative length), then causes a panic when used as a slice index (scratch[:negative]).
Bug 2: CWE-190 - Tensor.Elements() uint64 Overflow
File: fs/ggml/ggml.go lines 504-510
Tensor shape dimensions from the GGUF file are multiplied as uint64 without overflow checking. Crafted shapes like [0x8000000000000001, 2] cause the product to wrap to 2, making Size() return 8 bytes. This bypasses the bounds validation at gguf.go:259. The raw shape values are then passed to C ggml_new_tensor (ggml.go:276) where int64_t reinterpretation of 0x8000000000000001 = -9223372036854775807 triggers GGML_ASSERT(ne[i] > 0) failure.
Bug 3: CWE-789 - Unchecked Allocation Sizes
Files: fs/ggml/gguf.go line 206, fs/gguf/gguf.go readString/readTensor
File-controlled uint64/uint32 values used directly in make() without bounds checking. dims=0xFFFFFFFF causes make([]uint64, 4294967295) = 32GB allocation -> OOM panic.
Reproduction
1python3 generate_poc.py
2echo 'FROM ./poc_string_negative_int.gguf' > Modelfile
3ollama create test -f Modelfile
4# Observe: panic: runtime error: slice bounds out of range
Impact
Denial of service - Ollama server crashes when loading a crafted GGUF model file. Any user who downloads and runs a malicious model from a registry (e.g., HuggingFace, Ollama library) would crash their Ollama instance.
Affected Code
fs/ggml/gguf.go - readGGUFString, Decode (tensor parsing)fs/gguf/gguf.go - readString, readTensor, readArrayDatafs/gguf/tensor.go - NumValues (int64 overflow)fs/ggml/ggml.go - Tensor.Elements, Tensor.Sizeml/backend/ggml/ggml.go - C FFI boundary (ggml_new_tensor)
