ybgwon96/sdcpp-embedding-dtype-oob-write-poc

PoC: stable-diffusion.cpp custom-embedding heap out-of-bounds write (malicious .safetensors)

Target: leejet/stable-diffusion.cpp — Conditioner::load_embedding (src/conditioning/conditioner.hpp:250-253). Format: SafeTensors (.safetensors) textual-inversion embedding (also .pt/.ckpt/.gguf). Class: CWE-787 heap out-of-bounds write (attacker-controlled length + content), CWE-131 / CWE-682 (incorrect buffer-offset calculation across mixed tensor dtypes). Verified: source @ 68f3d6df9f1964e7f942dd242cc9c21b76fa273d; SIGSEGV reproduced (CRASH_PROVEN.md).

What it is

Custom embeddings are accumulated into one shared std::vector<uint8_t> token_embed_custom, with num_custom_embeddings counting the total rows added so far — both persist across calls. Each load_embedding grows the buffer by ggml_nbytes(embd) (this file's dtype) but computes the write offset as num_custom_embeddings * hidden_size * ggml_type_size(embd->type) — using this file's dtype size for all previously-added rows. If an earlier embedding used a smaller dtype (F16, 2 B) and the current one a larger dtype (F32, 4 B), the offset over-counts the earlier rows and the memcpy writes past the freshly-resized buffer — an OOB heap write whose size scales with the first embedding's row count (attacker-controlled) and whose bytes are the second embedding's contents.

Files

• embd_f16.safetensors — first embedding, dtype F16, shape [8000, 768].
• embd_f32.safetensors — second embedding, dtype F32, shape [1, 768].
• make_embeddings.py — regenerates both (python make_embeddings.py <R0> <outdir>); R0 sets the overflow size.
• embd_dtype_oob_repro.cpp / embd_dtype_oob_repro — isolated reproduction of the exact resize+memcpy arithmetic; SIGSEGVs at -O0.
• CRASH_PROVEN.md — run output + lldb backtrace + the offset math.

Trigger (real sd.cpp)

Place both files in the embeddings dir and reference both tokens in one prompt, e.g. sd -m model.safetensors --embd-dir . -p "a photo, embd_f16 embd_f32" — load_embedding is called for embd_f16 (F16) then embd_f32 (F32); the second call performs the OOB write.

Coordinated-disclosure security PoC for the huntr AI/ML bug-bounty program. No payload; it only demonstrates the memory-safety flaw.