Instructions to use salvepilo/llama-cpp-gemma3-divzero-poc with libraries, inference providers, notebooks, and local apps. Follow these links to get started.

Libraries

How to use salvepilo/llama-cpp-gemma3-divzero-poc with llama-cpp-python:

# !pip install llama-cpp-python

from llama_cpp import Llama

llm = Llama.from_pretrained(
	repo_id="salvepilo/llama-cpp-gemma3-divzero-poc",
	filename="poc_gemma3_divzero.gguf",
)

output = llm(
	"Once upon a time,",
	max_tokens=512,
	echo=True
)
print(output)

Notebooks
Google Colab
Kaggle
Local Apps Settings

llama.cpp

How to use salvepilo/llama-cpp-gemma3-divzero-poc with llama.cpp:

Install (macOS, Linux)

curl -LsSf https://llama.app/install.sh | sh
# Start a local OpenAI-compatible server with a web UI:
llama serve -hf salvepilo/llama-cpp-gemma3-divzero-poc
# Run inference directly in the terminal:
llama cli -hf salvepilo/llama-cpp-gemma3-divzero-poc

Install from WinGet (Windows)

winget install llama.cpp
# Start a local OpenAI-compatible server with a web UI:
llama serve -hf salvepilo/llama-cpp-gemma3-divzero-poc
# Run inference directly in the terminal:
llama cli -hf salvepilo/llama-cpp-gemma3-divzero-poc

Use pre-built binary

# Download pre-built binary from:
# https://github.com/ggerganov/llama.cpp/releases
# Start a local OpenAI-compatible server with a web UI:
./llama-server -hf salvepilo/llama-cpp-gemma3-divzero-poc
# Run inference directly in the terminal:
./llama-cli -hf salvepilo/llama-cpp-gemma3-divzero-poc

Build from source code

git clone https://github.com/ggerganov/llama.cpp.git
cd llama.cpp
cmake -B build
cmake --build build -j --target llama-server llama-cli
# Start a local OpenAI-compatible server with a web UI:
./build/bin/llama-server -hf salvepilo/llama-cpp-gemma3-divzero-poc
# Run inference directly in the terminal:
./build/bin/llama-cli -hf salvepilo/llama-cpp-gemma3-divzero-poc

Use Docker

docker model run hf.co/salvepilo/llama-cpp-gemma3-divzero-poc

LM Studio
Jan
Ollama
How to use salvepilo/llama-cpp-gemma3-divzero-poc with Ollama:
```
ollama run hf.co/salvepilo/llama-cpp-gemma3-divzero-poc
```

Unsloth Studio

How to use salvepilo/llama-cpp-gemma3-divzero-poc with Unsloth Studio:

Install Unsloth Studio (macOS, Linux, WSL)

curl -fsSL https://unsloth.ai/install.sh | sh
# Run unsloth studio
unsloth studio -H 0.0.0.0 -p 8888
# Then open http://localhost:8888 in your browser
# Search for salvepilo/llama-cpp-gemma3-divzero-poc to start chatting

Install Unsloth Studio (Windows)

irm https://unsloth.ai/install.ps1 | iex
# Run unsloth studio
unsloth studio -H 0.0.0.0 -p 8888
# Then open http://localhost:8888 in your browser
# Search for salvepilo/llama-cpp-gemma3-divzero-poc to start chatting

Using HuggingFace Spaces for Unsloth

# No setup required
# Open https://huggingface.co/spaces/unsloth/studio in your browser
# Search for salvepilo/llama-cpp-gemma3-divzero-poc to start chatting

Atomic Chat new
Docker Model Runner
How to use salvepilo/llama-cpp-gemma3-divzero-poc with Docker Model Runner:
```
docker model run hf.co/salvepilo/llama-cpp-gemma3-divzero-poc
```

Lemonade

How to use salvepilo/llama-cpp-gemma3-divzero-poc with Lemonade:

Pull the model

# Download Lemonade from https://lemonade-server.ai/
lemonade pull salvepilo/llama-cpp-gemma3-divzero-poc

Run and chat with the model

lemonade run user.llama-cpp-gemma3-divzero-poc-{{QUANT_TAG}}

List all available models

lemonade list

llama-cpp-gemma3-divzero-poc / README.md

salvepilo

Add README

2ce58b4 verified 8 days ago

preview code

Raw

History Blame Contribute Delete

1.03 kB

	---
	license: mit
	tags:
	- security
	- llama.cpp
	- gguf
	- poc
	---

	# llama.cpp Gemma3 Integer Division-by-Zero PoC

	Proof-of-concept for a division-by-zero vulnerability in llama.cpp's Gemma3 architecture loader.

	Vulnerable file: `src/models/gemma3.cpp:32`

	## Files

	- `poc_gemma3_divzero.gguf` — 235-byte malicious GGUF (no tensors, triggers SIGFPE on x86_64)
	- `reproducer.cpp` — standalone C++ reproducer (no llama.cpp build needed)

	## Quick test

	```bash
	# Standalone (no llama.cpp needed)
	g++ -o reproducer reproducer.cpp -fsanitize=undefined -fno-sanitize-recover=all
	./reproducer
	# Expected: runtime error: division by zero

	# With llama.cpp
	./llama-cli -m poc_gemma3_divzero.gguf -p 'hello'
	# Expected on x86_64: Floating point exception (exit 136)
	```

	## Root cause

	When `block_count=62` (→ `LLM_TYPE_27B`) and `attention.head_count` is absent from the GGUF,
	`n_head(0)` returns 0 and the expression `n_embd / n_head(0)` is integer division-by-zero.

	Reported via [Huntr](https://huntr.com) bug bounty program.