Darknet [yolo] mask= heap OOB read → crash PoC
malicious.cfg is a minimal Darknet model definition. Its [yolo] layer declares
num=3 (3 anchors, so l.biases is allocated as 3*2=6 floats / 24 bytes) but
mask=0,1,2000000000 — index 2000000000 is never checked against num.
darknet_cfg.cpp's parse_yolo_section() copies mask values straight into
l.mask with no range check, and yolo_layer.cpp's get_yolo_box() (called from
get_yolo_detections_v3() on every inference) indexes l.biases[2*l.mask[n]] /
l.biases[2*l.mask[n]+1] directly:
1int * mask = nullptr;
2if (not v.empty()) {
3 mask = (int*)xcalloc(v.size(), sizeof(int));
4 for (size_t i = 0; i < v.size(); i++) mask[i] = v[i]; // raw values, no range check
5}
malicious.weights is a completely well-formed, non-malicious weights file matching
malicious.cfg's declared layer shapes — the entire attack is in the .cfg.
Loading and running inference on this pair with the real hank-ai/darknet CLI
(darknet detector test obj.data malicious.cfg malicious.weights image.jpg) crashes
the process with SIGSEGV inside get_yolo_detections_v3(), caught by darknet's own
signal handler (exit code 134). Smaller out-of-range mask values (e.g. mask=10)
don't crash but do leak adjacent heap bytes into the reported detection bounding box
coordinates — a secondary output-manipulation/info-disclosure angle.
modelscan does not recognize .cfg/.weights as a supported format and skips the
file entirely ("No issues found" — see modelscan_output.txt), so a malicious pair
like this passes existing scanning tooling undetected.
Reported to huntr.com as a Model File Vulnerability (MFV) submission —
"Denial of Service through malformed model files" category.
