README.md

---
license: mit
tags:
  - security
  - proof-of-concept
  - gguf
  - denial-of-service
---

# PoC: Denial of Service in `gguf` (gguf-py) `GGUFReader` via unchecked ARRAY length

This repository contains a **49-byte** proof-of-concept GGUF file that triggers a
non-terminating loop with unbounded memory growth in the official `gguf` Python
package (`gguf.GGUFReader`). Loading the file for metadata inspection causes the
process to hang and consume memory until it is OOM-killed.

This artifact is for **defensive security research / responsible disclosure** only.

## Affected

- `gguf` (PyPI) **0.18.0**
- `gguf` (PyPI) **0.19.0**
- Upstream `ggml-org/llama.cpp` `gguf-py` at
  `b5f52280fb781cf63e7c3fb79f8bb8de215293e3` (verified after the `#19856`
  integer-overflow patch).

## Root cause

In `gguf/gguf_reader.py`, `_get_field_parts()` parses a metadata ARRAY by reading a
64-bit element count straight from the file and looping that many times:

```python
alen = self._get(offs, np.uint64)     # attacker-controlled element count
for idx in range(alen[0]):            # no bound vs. remaining file bytes
    curr_size, curr_parts, ... = self._get_field_parts(offs, raw_itype[0])
    aparts += curr_parts              # grows every iteration
    offs += curr_size                 # curr_size == 0 once past EOF
```

For a 1-byte element type (`UINT8`/`BOOL`), once `offs` reaches EOF the element read
returns an empty array (`curr_size == 0`), so `offs` never advances and the loop runs
up to `alen = 2**64-1` times, appending to `aparts` each iteration.

## Reproduce

```bash
pip install gguf==0.19.0
python -c "from gguf import GGUFReader; GGUFReader('poc_array_dos.gguf')"
# never returns; resident memory climbs ~230 MiB/s
```

Safe, time-boxed demonstration (sampling RSS, aborts after 8s):

```bash
python verify_dos.py poc_array_dos.gguf
```

Expected output: the parser is still running after 8s with RSS having grown >1 GiB
from a 49-byte input. A finite-length control (`make_poc.py out.gguf 0x2`) returns
in ~0.01s.

## Rebuild the PoC

```bash
python make_poc.py poc_array_dos.gguf 0xFFFFFFFFFFFFFFFF
```

## Suggested fix

Reject array lengths that exceed the remaining file size (each element is at least
1 byte), and add a progress guard for truncated elements, mirroring the bounds
checks already present in the C++ reader (`ggml/src/gguf.cpp`):

```python
remaining = self.data.size - offs
if alen[0] > remaining:
    raise ValueError(f'array length {int(alen[0])} exceeds remaining file size {remaining}')
...
if curr_size <= 0:
    raise ValueError('truncated GGUF ARRAY element')
```