heap-overflow
netcdf-cl4-dim-name-heap-overflowmfv-darknet-numload-heap-overflow-poc
Darknet (.cfg/.weights) Memory Corruption PoC
CWE-787/CWE-122: numload heap-buffer-overflow WRITE + OOB READ via route/shortcut
Bug 1: numload heap-overflow WRITE (headline)
filters=2 allocates 8-byte l.biases. numload=4096 rebinds l.n at weight-load time. fread(l.biases, sizeof(float), l.n=4096, fp) writes 16384 bytes into 8-byte buffer.
Bug 2/3: route/shortcut unbounded layer index -> OOB READ
layers=100000 or from=99999 indexes net->layers[] with… See the full description on the dataset page: https://huggingface.co/datasets/Talson/mfv-darknet-numload-heap-overflow-poc.cl22-v1h_get_NC_var-heap-overflownetcdf-cl7-H5Tget_native_type-heapoverflowtensorrt-engine-heap-overflow-pocpoc-heap-buffer-overflow-in-onnx-ort-format-id000025sig06src
heap-buffer-overflow in onnx-ort-format (id:000025,sig:06,src:000003+000011,time:18209060,execs:114108864,op:splice,rep:1)
Severity: high
CWE: CWE-122
Target: onnx-ort-format
Generated: 2026-03-01
Summary
heap-buffer-overflow in onnx-ort-format (id:000025,sig:06,src:000003+000011,time:18209060,execs:114108864,op:splice,rep:1). See ASAN output below for details.
Reproduction
chmod +x reproduce.sh
./reproduce.sh
Or manually:
# Build target with ASAN
# Run:… See the full description on the dataset page: https://huggingface.co/datasets/Rammadaeus/poc-heap-buffer-overflow-in-onnx-ort-format-id000025sig06src.