Views
No views yet
| Field | Value |
|---|---|
| Target | Mozilla-Ocho/llamafile v0.10.3 (stable-diffusion.cpp submodule) |
| File | stable-diffusion.cpp/src/model_io/gguf_reader_ext.h lines 114-125 |
| CWE | CWE-674 Uncontrolled Recursion |
| CVSS | 5.5 Medium (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) |
| Status | READY TO SUBMIT |
| Est. payout | $1,500 |
read_metadata() ARRAY case calls itself recursively with no depth limit; version=4 triggers GGUFReader fallback which has no version check.# generate
python3 poc_cwe674_array_recursion.py /tmp/poc.gguf
# build harness (once, from diffusionfile-poc/ parent)
g++ -std=c++17 -include cstring -I.. \
-I$HOME/targets/llamafile/stable-diffusion.cpp/src/model_io \
-o ../test_harness ../test_harness.cpp
# trigger
../test_harness /tmp/poc.gguf
# -> Segmentation fault (core dumped) exit 139| File | Purpose |
|---|---|
poc_cwe674_array_recursion.py | PoC generator -- produces 2 MB malicious GGUF |
submission.md | Full technical writeup (sanitized for huntr renderer) |
report.md | Plain prose for huntr form description field (zero markdown) |
poc-evidence.html | Self-contained HTML evidence page with terminal output |
README.md | This file |