Talson/llamafile-zip-overflow-poc

Llamafile ZIP parser integer wraparound → OOB read Vulnerability CWE-190/CWE-125: Integer Wraparound → Out-of-bounds Read in Llamafile's ZIP parser (llamafile/llamafile.c). get_zip_cfile_compressed_size() returns int64_t -1 when the central directory entry has COMPRESSEDSIZE=0xFFFFFFFF (ZIP64 sentinel) but no valid ZIP64 extra field. This -1 is assigned to size_t file->size (= SIZE_MAX on 64-bit), causing mapsize = skew + SIZE_MAX to wrap to a tiny value: //… See the full description on the dataset page: https://huggingface.co/datasets/Talson/llamafile-zip-overflow-poc.