hacnho/npy-npload-shape-header-allocation-dos-poc

NPY np.load() forged-shape header allocation DoS PoC

This repository contains a benign security research PoC for a tiny .npy file that forces a large allocation in np.load(path, allow_pickle=False).

Files:

• control_shape_2.npy
• malicious_shape_300m.npy
• reproduce.py
• requirements.txt

Tested environment:

• numpy==2.5.0

Observed behavior:

• control file:
  • size 136 bytes
  • np.load(..., allow_pickle=False) succeeds
• malicious file:
  • size 136 bytes
  • np.load(..., allow_pickle=False) raises: MemoryError: Unable to allocate 1.12 GiB for an array with shape (300000000,) and data type float32

Reproduction:

python3 -m venv /tmp/npy-shape-header-poc
/tmp/npy-shape-header-poc/bin/pip install -U pip
/tmp/npy-shape-header-poc/bin/pip install -r requirements.txt

curl -L -O https://huggingface.co/hacnho/npy-npload-shape-header-allocation-dos-poc/resolve/main/control_shape_2.npy
curl -L -O https://huggingface.co/hacnho/npy-npload-shape-header-allocation-dos-poc/resolve/main/malicious_shape_300m.npy
curl -L -O https://huggingface.co/hacnho/npy-npload-shape-header-allocation-dos-poc/resolve/main/reproduce.py
curl -L -O https://huggingface.co/hacnho/npy-npload-shape-header-allocation-dos-poc/resolve/main/requirements.txt

/tmp/npy-shape-header-poc/bin/python reproduce.py control_shape_2.npy malicious_shape_300m.npy

Public file URLs:

• https://huggingface.co/hacnho/npy-npload-shape-header-allocation-dos-poc/resolve/main/control_shape_2.npy
• https://huggingface.co/hacnho/npy-npload-shape-header-allocation-dos-poc/resolve/main/malicious_shape_300m.npy
• https://huggingface.co/hacnho/npy-npload-shape-header-allocation-dos-poc/resolve/main/reproduce.py