CoolFace
Datasetpublic

Talson/llamafile-zip-overflow-poc

Llamafile ZIP parser integer wraparound → OOB read Vulnerability CWE-190/CWE-125: Integer Wraparound → Out-of-bounds Read in Llamafile's ZIP parser (llamafile/llamafile.c). get_zip_cfile_compressed_size() returns int64_t -1 when the central directory entry has COMPRESSEDSIZE=0xFFFFFFFF (ZIP64 sentinel) but no valid ZIP64 extra field. This -1 is assigned to size_t file->size (= SIZE_MAX on 64-bit), causing mapsize = skew + SIZE_MAX to wrap to a tiny value: //… See the full description on the dataset page: https://huggingface.co/datasets/Talson/llamafile-zip-overflow-poc.

sourceHugging Faceupdated 3mo agoView on Hugging Face
0likes8downloads
Dataset Card

Llamafile ZIP parser integer wraparound → OOB read

Vulnerability

CWE-190/CWE-125: Integer Wraparound → Out-of-bounds Read in Llamafile's ZIP parser (llamafile/llamafile.c).

get_zip_cfile_compressed_size() returns int64_t -1 when the central directory entry has COMPRESSEDSIZE=0xFFFFFFFF (ZIP64 sentinel) but no valid ZIP64 extra field. This -1 is assigned to size_t file->size (= SIZEMAX on 64-bit), causing `mapsize = skew + SIZEMAX` to wrap to a tiny value:

c
// llamafile/llamafile.c:178
file->size = get_zip_cfile_compressed_size(cdirdata + entry_offset);
// int64_t(-1) → size_t = 0xFFFFFFFFFFFFFFFF (SIZE_MAX)

// llamafile/llamafile.c:227
file->mapsize = skew + file->size; // 40 + SIZE_MAX wraps to 39
file->mapping = mmap(0, file->mapsize, ...);
// mmap(39 bytes) creates tiny mapping, but...

// llamafile/llamafile.c:375-377 (llamafile_read)
size_t remain = file->size - file->position; // SIZE_MAX
size_t amt = Min(len, remain);               // = len
memcpy(ptr, file->content + file->position, amt); // OOB READ!

Confirmation

[*] Entry: 'model.gguf'
    get_zip_cfile_compressed_size() = -1 (0xffffffffffffffff)
    size_t file_size = 18446744073709551615 (0xffffffffffffffff)

[!] BUG TRIGGERED: compressed_size = -1 → file_size = SIZE_MAX!
    mapsize = skew + SIZE_MAX = 39 (wrapped!)
    mmap succeeded, mapsize=39
    remain = 18446744073709551615, reading 128 bytes...
    memcpy(buf, content + 0, 128) → OOB READ!

Reproduction

bash
git clone --depth=1 https://github.com/Mozilla-Ocho/llamafile.git
cd llamafile
python3 craft_malicious_zip.py
gcc -O1 -g harness.c -o harness
./harness malicious_llamafile.zip

Fix

Check get_zip_cfile_compressed_size() return value before assigning to file->size.