Views
No views yet
.ggml Tensor n_dims OOB Write PoC.ggml loaders in examples/gpt-2/main-ctx.cpp, examples/gpt-j/main.cpp, and examples/sam/sam.cpp read attacker-controlled n_dims from a .ggml file and use it as the loop bound for writes into a fixed-size stack array (int32_t ne[2] in GPT-2/GPT-J, int64_t ne[4] in SAM). No upper bound check happens before the writes, and the only gate is the GGML_FILE_MAGIC (0x67676d6c) check.AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)ggerganov/ggml 0.11.1 @ a056a26f508b6160438ddd8aabbc859d2a2e7a97 (master, 2026-05-10)examples/gpt-2/main-ctx.cpp:309-330 — https://github.com/ggerganov/ggml/blob/a056a26f508b6160438ddd8aabbc859d2a2e7a97/examples/gpt-2/main-ctx.cpp#L309-L330examples/gpt-j/main.cpp:305-326 — https://github.com/ggerganov/ggml/blob/a056a26f508b6160438ddd8aabbc859d2a2e7a97/examples/gpt-j/main.cpp#L305-L326examples/sam/sam.cpp:1040-1063 — https://github.com/ggerganov/ggml/blob/a056a26f508b6160438ddd8aabbc859d2a2e7a97/examples/sam/sam.cpp#L1040-L10631bash repro.sh
2cat /tmp/GGML_AUDIT.txtgpt-2-ctx with GGML_SANITIZE_ADDRESS=ON + GGML_SANITIZE_UNDEFINED=ON, generates a tiny malformed .ggml (57 bytes) where n_dims=3 against an int32_t ne[2] destination, runs the loader, observes the sanitizer crash, and drops /tmp/GGML_AUDIT.txt.1AddressSanitizer:DEADLYSIGNAL
2ERROR: AddressSanitizer: SEGV
3#1 ... in gpt2_model_load(...)
4GGML legacy tensor n_dims reproducer verifiedrepro.sh — full sanitizer reproducertensor-ndims-oob.ggml — 57-byte malicious .ggml (n_dims=3, three dim slots, name "x")repro.log — captured ASan output.ggml format (GGML_FILE_MAGIC = 0x67676d6c, old tensor triplet n_dims, length, ttype), not GGUF. The active llama.cpp loader at 927dada6 is GGUF-only and not affected here. The vulnerable parsers live in ggerganov/ggml examples.n_dims against the destination array size (ne length) before the loop write. The same pattern needs to be applied at each of the three sink sites; SAM's int64_t ne[4] should reject n_dims > 4, GPT-2/GPT-J's int32_t ne[2] should reject n_dims > 2. Also bound length and vocab-string lengths before allocation.lendtrain (huntr) / tonydav41 (HuggingFace). Filed 2026-05-12.