Views
No views yet
attn_window_size int-overflow heap OOB write (malicious GGUF mmproj)ggml-org/llama.cpp — tools/mtmd/clip.cpp (multimodal vision projector, PROJECTOR_TYPE_DEEPSEEKOCR/2).
Format: GGUF (mmproj / multimodal vision projector) — huntr high-value format.
Class: CWE-190 integer overflow → CWE-787 heap out-of-bounds write.
Verified: source @ 665892536dfb1b7532161e3182304bd35c33e768; SIGSEGV reproduced (CRASH_PROVEN.md).clip.vision.attn_window_size is read from the GGUF mmproj metadata into int window and is never
bounds-checked (the sanity block at clip.cpp:1684-1757 validates image_size/patch_size/n_embd/n_merge
but not attn_window_size). In the DeepSeek-OCR encode path (clip.cpp:4116):1const int window = hparams.attn_window_size;
2std::vector<int32_t> rel_pos_indices_local(window * window); // int*int -> 32-bit overflow
3for (int q = 0; q < window; q++)
4 for (int k = 0; k < window; k++)
5 rel_pos_indices_local[q * window + k] = q - k + window - 1; // writes window^2 entries -> OOBwindow = 65536 makes window*window overflow int to 0, so the vector is empty while the loops
write ~2^32 entries → heap OOB write with attacker-controlled length.window_size_repro.cpp / window_size_repro — isolated reproduction of the exact size expression +
write loop; SIGSEGVs at -O0 (see CRASH_PROVEN.md).patch_window_size.py — sets clip.vision.attn_window_size on a DeepSeek-OCR mmproj GGUF.CRASH_PROVEN.md — run output + lldb backtrace + the overflow math.clip.vision.attn_window_size = 65536 on a DeepSeek-OCR / DeepSeek-OCR2 mmproj GGUF and run any
image through it: llama-mtmd-cli -m <deepseek-ocr-text>.gguf --mmproj <evil-mmproj>.gguf --image any.png -p "ocr".
The DeepSeek-OCR encoder builds rel_pos_indices_local(window*window) and overruns it.