GGUF KV Array Element Type Out-of-Range — Native Loader Abort
Finding
A malformed GGUF file with an out-of-range inner_elem_type value inside a KV
array (GGUF_TYPE_ARRAY = 9) causes the native loader (gguf_init_from_file) to
abort unconditionally via assertion failure (SIGABRT, exit -6 / 134).
The assertion 0 <= type && type < GGUF_TYPE_COUNT fires before any element is
processed, regardless of the declared array count. Valid GGUF_TYPE values are
0–12 (GGUF_TYPE_COUNT = 13); any value ≥ 13 triggers the abort.
Crash site: gguf_init_from_file+0x7c0
Tested with: llama-cpp-python (llama.cpp wheel)
Distinctness
| Root | Field | Crash offset |
|---|---|---|
| ROUND_AI377 (prior, submitted) | KV entry outer type | +0x3d8 |
| ROUND_AI381 (prior, submitted) | Tensor info type | +0xfac |
| This finding | KV array elem type | +0x7c0 |
PoC Files
Six GGUF files in two sets:
| File | elem_type | count | Role |
|---|---|---|---|
arr_baseline.gguf |
6 (F32) | 0 | Baseline |
arr_mutant_0xff.gguf |
255 | 0 | Mutant (OOB) |
arr_mutant_13.gguf |
13 | 0 | Mutant (=GGUF_TYPE_COUNT) |
arr_len1_baseline.gguf |
6 (F32) | 1 | Baseline |
arr_len1_mutant_0xff.gguf |
255 | 1 | Mutant (OOB) |
arr_len1_mutant_13.gguf |
13 | 1 | Mutant (=GGUF_TYPE_COUNT) |
Mutation field: bytes 48–51 (uint32 LE, inner_elem_type inside the ARRAY KV value)
Observed Behavior
- C native loader: SIGABRT for all 4 mutants (12/12 runs). Assertion fires before
element iteration, independent of
array_count. - Python
ggufreader (len0): Accepts mutants —range(0)loop never callsGGUFValueType(elem_type), so the invalid value is not validated. - Python
ggufreader (len1): Rejects mutants withValueError—GGUFValueType(255)raises on first element.
The security-relevant issue is the native loader abort path: an invalid
inner_elem_type value unconditionally aborts the loading process regardless of
array count.
Reproduction
pip install llama-cpp-python gguf
python reproduce.py
Expected output summary: PASS — 12/12 SIGABRT confirmed
python inspect_artifacts.py
Verifies SHA256 hashes and prints byte-level layout of mutation field.
Evidence Files
| File | Contents |
|---|---|
runtime_results.json |
Unified run table (12/12 SIGABRT) |
hash_matrix.json |
SHA256 + layout for all 6 PoC files |
source_mapping_array_elem_type.json |
GGUF_TYPE enum + binary confirmation |
distinctness_matrix.json |
7-dimension comparison vs prior roots |
SHA256
See SHA256SUMS.txt.