GGUF / llama.cpp — memory-safety PoC bundle (responsible disclosure)
Private PoC repository for a huntr (Protect AI) Model File Format bounty submission.
Every bug reproduces on llama.cpp HEAD simply by loading a crafted .gguf via
llama_model_load_from_file (or the container parser). Do not load these files outside a
sandbox — they are crafted to crash / corrupt the GGUF loader.
oob_write/ — HIGH (heap out-of-bounds write)
Root cause: <arch>.block_count -> hparams.n_layer_all is never clamped to LLAMA_MAX_LAYERS=512
(while n_expert is clamped). Per-layer arrays are std::array<uint32_t,512>.
poc1_gemma2_swa_write.gguf (235 B) -> ASAN heap-buffer-overflow WRITE @ llama-hparams.cpp:15 (set_swa_pattern)poc2_qwen35_recr_write.gguf (539 B) -> WRITE @ models/qwen35.cpp:25poc4_specialid_oob.gguf (329 B) -> heap-use-after-free READ @ llama-vocab.cpp:2848poc5_scores_typeconf.gguf -> heap-buffer-overflow READ @ llama-vocab.cpp:2419 (array element-type confusion)
See oob_write/WRITEUP.md, oob_write/SUMMARY.md, and the raw asan_*.log files.
divzero/ — MEDIUM (crash-on-load DoS)
poc_divzero.gguf (65 B) -> SIGFPE (integer division-by-zero) @ ggml/src/gguf.cpp:681
(tensor ne[j]==0, only checked >=0). Reproduced on a stock Release build (exit 136).
