Modelpublic

jdhart81/sd-cpp-gguf-reader-crash-poc

sourceHugging Facemitupdated 7mo agoView on Hugging Face

0likes

Model Card

SD-CPP-001: stable-diffusion.cpp GGUFReader Process Crash PoC

Security Research — Responsible Disclosure

Vulnerability

Three input validation failures in src/gguf_reader.hpp (GGUFReader class) of stable-diffusion.cpp allow an attacker to crash any process loading a malformed GGUF file.

Bug	Line	Root Cause	Impact
1	62	`std::string key(key_len, '\0')` with no bound check	`std::length_error` uncaught -> `std::terminate()`
2	140	`info.name.resize(name_len)` with no bound check	`std::bad_alloc` not caught by `catch(runtime_error)`
3	155	`shape[3] *= shape[4]` signed int64 multiply	Undefined behavior (signed overflow)

Commit: d6dd6d7b555c233bb9bc9f20b4751eb8c9269743

Reproduction

bash

python3 poc_sd_cpp_gguf_reader.py
# Generates 3 PoC files (32-92 bytes each)

# Build stable-diffusion.cpp from source
git clone https://github.com/leejet/stable-diffusion.cpp
cd stable-diffusion.cpp && mkdir build && cd build
cmake .. && cmake --build . --config Debug

# Trigger crash
./bin/sd --model /path/to/poc_metadata_oob.gguf -p "test" -o /dev/null
# Expected: "terminate called after throwing an instance of 'std::length_error'"

Trigger Condition

GGUFReader is a fallback parser invoked when gguf_init_from_file() fails (model.cpp:419). A GGUF file with version=999 triggers this fallback reliably. The fallback parser performs zero validation on length fields read from the file.

Suggested Fix

Add upper-bound validation before string allocations and widen the catch block:

cpp

// Line 62: bound key_len
if (key_len > 65536) { LOG_ERROR("key_len too large"); return false; }

// Line 214: catch all exceptions, not just runtime_error
} catch (const std::exception& e) {

Reporter

Viridis Security (Justin Hart) — viridisnorthllc@gmail.com