YAML Metadata Warning:empty or missing yaml metadata in repo card
Check out the documentation for more information.
huntr PoC - Heap OOB Write in Darknet parse_yolo_section (anchors=) (CWE-787)
Malicious model config: PoC_yolo_oob_write.cfg (204 bytes, SHA-256 3f9bad21d1e270974b5158a9ac3cc6c2a5337bcb751329d950004f2d773d561d)
Loading this crafted Darknet .cfg triggers a heap out-of-bounds WRITE in
Darknet::CfgFile::parse_yolo_section (src-lib/darknet_cfg.cpp:1719) on model load. The [yolo]
section's anchors= float list is copied into l.biases (allocated num*2 floats in
yolo_layer.cpp:372) with the loop bounded by the anchors count, NOT the allocation. num=3 ->
biases=6 floats=24 bytes; anchors= supplies 20 values -> write past the 24-byte region. Attacker
controls both overflow length and written values.
Reached via the standard load path: load_neural_network -> load_network_custom ->
parse_network_cfg_custom -> create_network -> parse_yolo_section. Reproduces on
hank-ai/darknet HEAD d17e352 with AddressSanitizer:
WRITE of size 4 ... 0 bytes after a 24-byte region ... darknet_cfg.cpp:1719.
PoC artifact for a huntr Model File Format (Darknet) disclosure.