Hironabe333/gguf-tensor-ndims-abort-poc

GGUF tensor n_dims abort — PoC package

Round: ROUND_AI415
Target: llama-cpp-python 0.2.90 (bundled llama.cpp)
Finding: GGUF tensor_info.n_dims field set to 5 (exceeding GGML_MAX_DIMS=4) causes deterministic SIGABRT in the C runtime while Python GGUFReader accepts the file without error.
Impact: Denial of service — process abort when loading a malformed GGUF model file.

---

Files

File	Description
baseline.gguf	Valid minimal GGUF v3: 1 tensor, n_dims=1, ne=[4], F32, offset=0
g1_n_dims_5.gguf	Primary PoC: tensor_info.n_dims=5 (> GGML_MAX_DIMS=4), ne=[4,1,1,1,1]
g1b_n_dims_0.gguf	Supporting variant: tensor_info.n_dims=0 (below valid range 1..4)
g4_ne0_overflow.gguf	Supporting variant: ne[0]=INT64_MAX (size arithmetic overflow guard)
reproduce.py	Automated reproduction script (A1–A7 assertions, 8/8 PASS)
inspect_artifacts.py	Artifact inspection + distinctness verification (I1–I7, 25/25 PASS)
runtime_results.json	C runtime + Python reader probe results
python_reader_results.json	GGUFReader per-file outcomes
crash_trace_summary.json	SIGABRT assert messages and call chains
distinctness_matrix.json	Distinctness from prior GGUF submissions
hash_matrix.json	SHA256 for all PoC files
README.md	このファイル
SHA256SUMS.txt	SHA256 checksums

---

Reproduction

pip install llama-cpp-python==0.2.90
python reproduce.py

Expected output: Results: 8/8 PASS / All assertions passed.

---

How the PoC works

GGUF v3 tensor info stores n_dims (uint32) as the number of tensor dimensions, followed by ne[n_dims] (int64 each). GGML_MAX_DIMS is 4.

g1_n_dims_5.gguf sets tensor_info.n_dims = 5. When gguf_init_from_file reads this value and reaches the validation check, it calls ggml_abort() instead of returning a load error:

ggml.c:21301: GGML_ASSERT(info->n_dims <= GGML_MAX_DIMS) failed

Python GGUFReader does not validate n_dims and returns a tensor with shape=[4, 1, 1, 1, 1] without any error or warning.

---

Crash trace (G1 primary)

ggml.c:21301: GGML_ASSERT(info->n_dims <= GGML_MAX_DIMS) failed
libggml.so(ggml_abort+0x11c)
libggml.so(gguf_init_from_file+0xf4c)
libllama.so(llama_model_loaderC2+0x318)
libllama.so(llama_load_model_from_file+0x29c)

---

Tested environment

Item	Value
llama-cpp-python	0.2.90
Python	3.10.12
Platform	Linux aarch64
GGML_MAX_DIMS	4
Reproducibility	4/4 SIGABRT (g1_n_dims_5.gguf)

---

Non-claims

• No RCE, no ACE, no arbitrary code execution
• No memory corruption confirmed
• No arbitrary read/write
• No ASAN/UBSAN OOB confirmed
• No High/Critical/CVSS claim
• Not claiming all llama.cpp versions are affected
• Not claiming all GGUF consumers are affected
• Impact is denial of service / process abort only
• Scoped to llama-cpp-python 0.2.90 on tested platform