jdhart81/darknet-weights-heap-overflow-poc

Darknet .weights Integer Overflow -> Heap Buffer Overflow PoC

Vulnerability

Integer overflow in transpose_matrix() (src/parser.c:1087) in Darknet when loading crafted .weights files leads to heap buffer overflow.

CWE: CWE-190 (Integer Overflow) -> CWE-122 (Heap Buffer Overflow)

Root Cause

When a .weights file has major > 1000, transpose flag is set. In transpose_matrix():

• —calloc(rows * cols, sizeof(float)) where rows=65536, cols=65537
• —65536 * 65537 = 4,295,032,832 overflows int32 to 65536
• —Only 262,144 bytes allocated, but loops write 4,295,032,832 elements

Files

• —poc_overflow.weights - Malicious weights file
• —poc_overflow.cfg - Network config
• —generate_poc.py - PoC generator

Reproduction

1. 1.Build darknet with ASan
2. 2.Create test harness that calls parsenetworkcfg() + load_weights()
3. 3.Run with pocoverflow.cfg and pocoverflow.weights
4. 4.ASan reports heap-buffer-overflow in transpose_matrix at parser.c:1091

Impact

Heap memory corruption -> DoS + potential ACE

Affected

pjreddie/darknet, hank-ai/darknet, AlexeyAB/darknet