Datasetpublic

Talson/mfv-caffe-intoverflow-memcorrupt-poc

Caffe (.caffemodel) Integer Overflow PoC CWE-190/CWE-122: TileLayer int overflow -> heap-overflow WRITE + im2col stack-overflow WRITE Bug 1: TileLayer (headline) tiles=1073741825 with shape(axis)=4: product overflows int32 to 4. Reshape allocates 16 bytes. Forward_cpu iterates 1073741825 times writing past the buffer. Attacker controls overflow content via weights. Bug 2: im2col pad_h=1073741823: 2*pad_h overflows int32. Output dimension computation… See the full description on the dataset page: https://huggingface.co/datasets/Talson/mfv-caffe-intoverflow-memcorrupt-poc.

sourceHugging Faceupdated 3mo agoView on Hugging Face

0likes3downloads

Dataset Card

Caffe (.caffemodel) Integer Overflow PoC

CWE-190/CWE-122: TileLayer int overflow -> heap-overflow WRITE + im2col stack-overflow WRITE

Bug 1: TileLayer (headline)

tiles=1073741825 with shape(axis)=4: product overflows int32 to 4. Reshape allocates 16 bytes. Forward_cpu iterates 1073741825 times writing past the buffer. Attacker controls overflow content via weights.

Bug 2: im2col

pad_h=1073741823: 2*pad_h overflows int32. Output dimension computation wraps, causing OOB write in the im2col column buffer.

Build & Run

bash

# In Caffe source tree, build with ASAN:
g++ -std=c++14 -fsanitize=address -g -O0 -DCPU_ONLY -Iinclude harness_tile.cpp -o harness_tile
g++ -std=c++14 -fsanitize=address -g -O0 -DCPU_ONLY -Iinclude harness_im2col.cpp -o harness_im2col
./harness_tile    # heap-buffer-overflow WRITE
./harness_im2col  # stack-buffer-overflow WRITE