You can deploy this model and start earning money today!

Abhnv7/
huntr-poc-bug04-surrealml-inputdims-panic

Name: huntr-poc-bug04-surrealml-inputdims-panic
Availability: InStock

Views

No views yet

Huntr PoC: SurrealML `InputDims::from_string` out-of-bounds index panic

Target

Program: surrealml (surrealml-core)
Repo: https://github.com/surrealdb/surrealml
Commit: 152ac2d508f1bae9ee62c46b7d211d80e40a6425
Affected file: modules/core/src/storage/header/input_dims.rs
Affected function: InputDims::from_string()
Affected line: 36 — dims: [dims[0], dims[1]] — panics when dims.len() < 2

Summary

InputDims::from_string() splits the input-dims header field on ,, collects results into a Vec, then unconditionally indexes dims[0] and dims[1]. If the field contains fewer than two comma-separated integers (e.g. "1"), dims.len() == 1 and dims[1] panics with index out of bounds. A second panic site exists at the parse::<i32>().unwrap() call — any non-numeric token also aborts. A 45-byte crafted file reliably triggers the OOB panic.

Files

File	Description
`poc_bug04.surml`	45-byte malicious `.surml` triggering the panic
`generate_poc_bug04.py`	Python script that generates the PoC
`BUG04-actual-log.txt`	Actual panic output + full stack backtrace
`BUG04-verdict.md`	Full verdict with source analysis

Reproduction

Step 1 — Generate PoC

bash

python3 generate_poc_bug04.py
# produces poc_bug04.surml (45 bytes)

Step 2 — Trigger panic

rust

use surrealml_core::storage::surml_file::SurMlFile;
let _ = SurMlFile::from_file("poc_bug04.surml");

RUST_BACKTRACE=1 cargo run -- poc_bug04.surml

Actual Output

thread 'main' panicked at modules/core/src/storage/header/input_dims.rs:36:33:
index out of bounds: the len is 1 but the index is 1
stack backtrace:
   0: rust_begin_unwind
   1: core::panicking::panic_fmt
   2: core::panicking::panic_bounds_check
   3: <usize as core::slice::index::SliceIndex<[T]>>::index
   4: core::slice::index::<impl core::ops::index::Index<I> for [T]>::index
   5: <alloc::vec::Vec<T,A> as core::ops::index::Index<I>>::index
   6: surrealml_core::storage::header::input_dims::InputDims::from_string
             at modules/core/src/storage/header/input_dims.rs:36:33
   7: surrealml_core::storage::header::Header::from_bytes
             at modules/core/src/storage/header/mod.rs:190:26
   8: surrealml_core::storage::surml_file::SurMlFile::from_file
             at modules/core/src/storage/surml_file.rs:124:22
EXIT: 101

Impact

Severity: Medium (DoS)

Deterministic process panic (abort with exit code 101) via 45-byte crafted .surml.
Two distinct panic sites in the same function: OOB index at line 36, and parse().unwrap() before it.
Affects SurMlFile::from_file(), SurMlFile::from_bytes(), and the load_model() C FFI.
No memory corruption. No data disclosure. Pure denial-of-service.
Separate root cause and fix location from BUG03 — warrants its own report.

Environment

OS: macOS 26.5.1 (arm64 / Apple Silicon)
Rust: 1.96.0 (rustc ac68faa20)
surrealml commit: 152ac2d508f1bae9ee62c46b7d211d80e40a6425
PoC file: poc_bug04.surml
- Size: 45 bytes
- SHA256: a2cb664a6fbed4a5a70decb91343a9bbf377f6de25b5eb4e1d0a2c700064a447

Abhnv7/huntr-poc-bug04-surrealml-inputdims-panic

Huntr PoC: SurrealML InputDims::from_string out-of-bounds index panic