Civitasmass/gguf-nul-key-alias-poc

PoC: GGUF embedded-NUL metadata-key parser differential in llama.cpp

Coordinated-disclosure security PoC for the Huntr gguf / llama.cpp bounty. Not a usable model. Access is gated to protectai-bot for review.

GGUF keys are length-prefixed and may contain embedded NUL. llama.cpp detects duplicate keys with length-aware std::string equality but resolves keys at runtime with strcmp(key, c_str()), which truncates at the first NUL and takes the first match. Every spec-conformant reader (gguf-py and the scanners built on it) is length-aware and resolves the canonical key. So one file shows benign metadata to inspectors while llama.cpp uses a hidden alias.

Files

• poc_submission.gguf — vocab-only model that loads in llama.cpp.
  • canonical tokenizer.chat_template → benign template (what scanners/gguf-py see)
  • tokenizer.chat_template\x00runtime (stored first) → Jinja2 SSTI demonstrator (what llama.cpp serves)
• malicious_canonical.gguf — control: identical payload in the canonical key (a scanner MUST flag this).
• poc_minimal.gguf — secondary impact: general.alignment\x00runtime=32 vs general.alignment=4096 → llama.cpp vs gguf-py read different tensor-data bytes (0xA5 vs 0x5A).
• verify_submission.py, build_submission_poc.py — reproduction.

Reproduce

pip install gguf llama-cpp-python modelaudit
python verify_submission.py          # gguf-py sees benign; llama.cpp serves malicious
modelaudit poc_submission.gguf       # -> NO ISSUES FOUND   (bypass)
modelaudit malicious_canonical.gguf  # -> CRITICAL          (same payload, canonical key)

The SSTI string is the standard non-destructive os.popen('id') demonstrator; the reported issue is the concealment / parser differential, not template SSTI itself.