Ano1X8/candle-gguf-poc

candle-transformers GGUF unbounded-allocation DoS — PoC model

Security proof-of-concept for a CWE-770 unbounded memory allocation in candle-transformers ModelWeights::from_gguf. Submitted via huntr Model File Vulnerability (format: GGUF).

⚠️ This repository hosts a crafted GGUF file for authorized security testing only. It is a ~600-byte denial-of-service PoC (no code execution). Do not load it in production.

The bug

llama.block_count is read verbatim from GGUF metadata and passed to Vec::with_capacity(block_count) with no upper bound (candle-transformers/src/models/quantized_llama.rs, ModelWeights::from_gguf). block_count = 0xFFFFFFFF requests ≈ 2.99 TB → allocator fails → rust_oom → process abort. candle-core's GGUF parser caps array/string/dim maxima, but this scalar reaches the model-builder layer unchecked.

Files

File	Purpose
candle_sink2.gguf	PoC — llama.block_count = 0xFFFFFFFF → abort
candle_benign.gguf	control — block_count = 2, proceeds past the sink
make_candle_gguf.py	generator for both files (uses the gguf writer)
EVIDENCE.txt	run log of the SIGABRT + backtrace
SHA256.txt	checksums

Reproduce (RUN-VERIFIED, candle HEAD 31f35b1)

git clone https://github.com/huggingface/candle && cd candle
cargo build --release --example quantized
./target/release/examples/quantized --model candle_sink2.gguf --prompt hi -n 1

Result:

memory allocation of 2989297237320 bytes failed
   0: std::alloc::rust_oom
   2: alloc::alloc::handle_alloc_error
   4: <candle_transformers::models::quantized_llama::ModelWeights>::from_gguf::<std::fs::File>

Control (--model candle_benign.gguf) proceeds past the sink and fails cleanly with cannot find tensor info for blk.0.attn_q.weight, isolating the abort to the unchecked block_count.

Impact

Any application/service loading an attacker-supplied GGUF via candle-transformers is aborted by a ~600-byte file. Same class as the paid ollama GGUF DoS (CVE-2025-0315).