Views
No views yet
| Field | Value |
|---|---|
| Format | Darknet (.cfg / .weights) |
| Parser | hank-ai/darknet (commit d17e352, 2026-05-20) |
| Platform | huntr.com — Model File Formats program |
| CWE | CWE-125 (Out-of-Bounds Read) |
| CVSS | 7.5 (High) |
parse_shortcut_section() in src-lib/darknet_cfg.cpp (line 1771–1783) adjusts negative from= values relative to the current layer index but performs no lower-bound check and no upper-bound check on the result before indexing net.layers[]:1int index = v[i];
2if (index < 0)
3 index = parms.index + index; // ← adjusted, but never validated
4
5sizes[i] = net.layers[index].outputs; // ← OOB read
6layers_output[i] = net.layers[index].output; // ← OOB pointer read
7layers_delta[i] = net.layers[index].delta; // ← OOB pointer readnet.layers is allocated for exactly net.n layers (= number of sections in the .cfg). A from=999999999 reads ~45 GB past the allocation; from=-100 with only 1 prior layer resolves to index -99, reading before the array base.darknet predict evil_shortcut.cfg
→ parse_network_cfg()
→ CfgFile::create_network()
→ parse_shortcut_section() ← from=999999999, no bounds check
→ net.layers[999999999].outputs ← CRASH (OOB read, SIGSEGV / ASAN)| File | Trigger |
|---|---|
evil_shortcut.cfg | [shortcut] from=999999999 — OOB beyond array end |
evil_route.cfg | [route] layers=-100 — OOB before array start |
1git clone https://github.com/hank-ai/darknet
2cd darknet && cmake -B build -DDARKNET_TRY_CUDA=OFF && cmake --build build
3./build/src-cli/darknet predict evil_shortcut.cfg
4# → Segmentation fault / ASAN: heap-buffer-overflowparse_shortcut_section() and parse_route_section():1if (index < 0 || index >= (int)parms.index)
2{
3 darknet_fatal_error(DARKNET_LOC,
4 "layer reference %d is out of range [0, %d)", v[i], (int)parms.index);
5}