kpanuragh/llamacpp-gguf-loader-pocs

llama.cpp GGUF loader — security PoC model files

⚠️ Security research artifacts. These .gguf files are deliberately malformed proof-of-concept inputs that trigger memory-safety bugs in the llama.cpp GGUF model loader when loaded. They contain no executable payload and only cause a crash (out-of-bounds memory access) on load. Published as the PoC for a coordinated vulnerability disclosure (huntr Model Format Vulnerability program). Do not load untrusted model files outside a sandbox.

Reproduced on llama.cpp commit 4d8cc0c.

Files

File	Bug	Effect on load
poc_f1_oob_write.gguf (288 B)	Unbounded block_count → n_layer	Heap out-of-bounds write
poc_f2_oob_read.gguf (704 B)	Short precompiled_charsmap (UGM/T5)	Heap out-of-bounds read
gen_gguf_f1.py, gen_gguf_f2.py	Generators (use llama.cpp's own gguf-py)	—

F1 — heap OOB write via unbounded n_layer

<arch>.block_count is read into hparams.n_layer with no upper bound (src/llama-model.cpp:1005). n_layer indexes fixed 512-element arrays (LLAMA_MAX_LAYERS, src/llama-hparams.h:9). For architectures such as gemma3, load_arch_hparams calls set_swa_pattern, whose loop for (il=0; il<n_layer; ++il) swa_layers[il] = … (src/llama-hparams.cpp:15) writes past the array. The only bound check (get_key_or_arr, src/llama-model-loader.cpp:447) sits after a required=false early-return, so omitting feed_forward_length / attention.head_count / attention.head_count_kv bypasses it. The crafted file sets gemma3.block_count = 0x40000000 and omits those keys.

F2 — heap OOB read via short precompiled_charsmap

The T5/UGM tokenizer ctor reads *(const uint32_t *) &precompiled_charsmap[0] (src/llama-vocab.cpp:864) after only checking size() > 0. A 1-byte charsmap makes the 4-byte read run past the heap buffer.

Reproduce (AddressSanitizer)

git clone https://github.com/ggml-org/llama.cpp && cd llama.cpp
git checkout 4d8cc0c
cmake -B build-asan -DCMAKE_BUILD_TYPE=RelWithDebInfo \
  -DLLAMA_SANITIZE_ADDRESS=ON -DLLAMA_CURL=OFF \
  -DLLAMA_BUILD_TESTS=OFF -DLLAMA_BUILD_EXAMPLES=OFF
cmake --build build-asan --target llama-cli -j"$(nproc)"

ASAN_OPTIONS=detect_leaks=0 ./build-asan/bin/llama-cli -m poc_f1_oob_write.gguf -p x -n 1 --no-warmup
#  => AddressSanitizer: heap-buffer-overflow WRITE of size 4 in set_swa_pattern (src/llama-hparams.cpp:15)

ASAN_OPTIONS=detect_leaks=0 ./build-asan/bin/llama-cli -m poc_f2_oob_read.gguf -p x -n 1 --no-warmup
#  => AddressSanitizer: heap-buffer-overflow READ of size 4 in llm_tokenizer_ugm (src/llama-vocab.cpp:864)

Suggested fixes

• F1: validate n_layer <= LLAMA_MAX_LAYERS immediately after llama-model.cpp:1005; bound per-layer accessors against array capacity.
• F2: require precompiled_charsmap.size() >= sizeof(uint32_t) and use memcpy.