YAML Metadata Warning:empty or missing yaml metadata in repo card
Check out the documentation for more information.
PoC: Heap buffer overflow (OOB write) in Darknet .cfg parsing
evil.cfg is a Darknet model config. Loading it via the public API
(parse_network_cfg / load_network) triggers a controllable heap out-of-bounds
WRITE while parsing the [yolo] section โ before any .weights file is read.
Root cause: src-lib/yolo_layer.cpp:372 allocates l.biases = xcalloc(num*2, sizeof(float))
(num defaults to 1 โ 8 bytes), then src-lib/darknet_cfg.cpp:1716 copies the attacker's
entire anchors= float list into it with NO bound (the sibling [region] parser has
&& i < num*2; [yolo] and [Gaussian_yolo] dropped it). CWE-787.
Reproduce (faithful sink, no OpenCV needed)
g++ -fsanitize=address -g asan_repro.cpp -o asan_repro
./asan_repro evil.cfg
AddressSanitizer reports heap-buffer-overflow ... WRITE of size 4. In the real binary
the overflow lands in l.biases during parse_yolo_section.