---
license: mit
language: en
tags:
- security
- poc
- gguf
- dos
- llama.cpp
---

# GGUF Python Reader -- Missing Bounds Checks (DoS)

## Summary

The Python GGUF reader in llama.cpp's `gguf-py` library lacks the input
validation bounds that the C++ implementation has, allowing a maliciously
crafted GGUF file to cause denial of service through excessive memory
allocation or infinite looping.

The C++ parser caps string lengths and array counts at 1 GiB
(GGUF_MAX_STRING_LENGTH, GGUF_MAX_ARRAY_ELEMENTS). The Python parser
has no equivalent checks.

## Affected code

- Repository: https://github.com/ggerganov/llama.cpp
- File: `gguf-py/gguf/gguf_reader.py`
- Commit tested: `aa50b2c2ae91326d5aad956ceeb015d1d48e626b`

## PoC file

`malicious_gguf.gguf` -- a 44-byte file that declares 100 million key-value
pairs in its header, causing the parser to iterate endlessly.

## Reproduction

```bash
pip install gguf numpy
python reproduce.py
```

Expected: the script hangs indefinitely trying to parse a 44-byte file.

## Impact

Any Python application using `GGUFReader` on untrusted GGUF files is
affected. This includes CLI tools shipped with gguf-py and any application
that loads GGUF models from user-supplied paths.

## Fix

Add the bounds checks from the C++ implementation to the Python reader:
- Maximum string length
- Maximum array element count
- KV pair and tensor count validation before iteration