| # GGML legacy loader — n_dims stack out-of-bounds write (PoC model file) |
| |
| Security proof-of-concept for a stack-buffer-overflow WRITE triggered when a |
| GGML legacy-format model file declares an out-of-range tensor `n_dims`. |
|
|
| - `evil-ggml.bin` (61 bytes): valid `ggml` magic + a minimal header, one tensor |
| record whose `n_dims` field is set to 3. |
| - Affected reference loader: `ggml-org/ggml`, `examples/gpt-2`, |
| `gpt2_model_load` — the `fin.read(&ne[i], 4)` call inside the |
| `for (i = 0; i < n_dims; ++i)` loop writes past the 2-element stack array |
| `int32_t ne[2]`. |
| - Observed effect: AddressSanitizer reports `stack-buffer-overflow`, |
| `WRITE of size 4`, top application frame `gpt2_model_load`. |
|
|
| This artifact exists only to demonstrate the parsing flaw to maintainers and the |
| huntr Model File Vulnerability track. It contains no real model weights. |
|
|
