oguzhanakkaya/poc-wavtokenizer-posnet-oob-gguf

Security PoC — llama.cpp wavtokenizer-dec posnet/convnext block_count OOB

This repository contains a deliberately-malformed GGUF file that triggers an out-of-bounds access in llama.cpp's wavtokenizer-dec model loader.

The wavtokenizer-dec.posnet.block_count and wavtokenizer-dec.convnext.block_count GGUF metadata keys are read without any upper-bound validation against the base block_count (nlayerall). This causes dev_layer.at(il) to throw std::out_of_range when the loader tries to create tensors for posnet/convnext layers beyond the allocated range.

Impact

Attacker-controlled GGUF metadata → crash on model load (DoS).

Trigger

llama-cli -m poc_wavtokenizer_posnet_oob.gguf -n 1 -p "a"
# -> vector::_M_range_check: __n (which is 1) >= this->size() (which is 1)

Generator

python3 poc_wavtokenizer_posnet_oob.py

Disclosure

Reported via huntr MFV program. This is a sibling bug to the n_layer_all fix merged in llama.cpp PR #26051 — the base block_count was bounded but posnet.block_count and convnext.block_count were missed.