mfv-poc
Datasets
All datasets matching “mfv-poc”mfv-darknet-numload-heap-overflow-poc
Darknet (.cfg/.weights) Memory Corruption PoC
CWE-787/CWE-122: numload heap-buffer-overflow WRITE + OOB READ via route/shortcut
Bug 1: numload heap-overflow WRITE (headline)
filters=2 allocates 8-byte l.biases. numload=4096 rebinds l.n at weight-load time. fread(l.biases, sizeof(float), l.n=4096, fp) writes 16384 bytes into 8-byte buffer.
Bug 2/3: route/shortcut unbounded layer index -> OOB READ
layers=100000 or from=99999 indexes net->layers[] with… See the full description on the dataset page: https://huggingface.co/datasets/Talson/mfv-darknet-numload-heap-overflow-poc.mfv-tflite-offset-overflow-poc
TFLite (.tflite) Integer Overflow PoC
CWE-190/CWE-125: offset+size uint64_t overflow in interpreter_builder.cc:671 -> OOB READ
Bug
Buffer offset and size (both uint64_t from flatbuffer) overflow when added in bounds check at interpreter_builder.cc:671. The overflowed sum passes the check, but the original offset is used for pointer arithmetic, yielding an OOB pointer.
Example: offset=0xFFFFFFFFFFFFFF00, size=0x200 -> offset+size=0x100 (overflows) -> check passes… See the full description on the dataset page: https://huggingface.co/datasets/Talson/mfv-tflite-offset-overflow-poc.mfv-caffe-intoverflow-memcorrupt-poc
Caffe (.caffemodel) Integer Overflow PoC
CWE-190/CWE-122: TileLayer int overflow -> heap-overflow WRITE + im2col stack-overflow WRITE
Bug 1: TileLayer (headline)
tiles=1073741825 with shape(axis)=4: product overflows int32 to 4. Reshape allocates 16 bytes. Forward_cpu iterates 1073741825 times writing past the buffer. Attacker controls overflow content via weights.
Bug 2: im2col
pad_h=1073741823: 2*pad_h overflows int32. Output dimension computation… See the full description on the dataset page: https://huggingface.co/datasets/Talson/mfv-caffe-intoverflow-memcorrupt-poc.mfv-cntk-resize-overflow-poc
CNTK v2 Integer Overflow PoC
CWE-190/CWE-122: CPUMatrix::Resize numRows*numCols size_t overflow -> heap-buffer-overflow WRITE
Bug
CPUMatrix::Resize(numRows=3, numCols=0x5555555555555556): 3 * 0x5555555555555556 = 2 (overflows size_t). Allocates 2 elements (8 bytes), stores original dims. LocateElement(0,1) = 1*3 = 3 -> index 3 past 2-element buffer -> OOB WRITE.
3 entry points:
Direct Resize (core bug)
operator>> deserialization (BMAT section with raw… See the full description on the dataset page: https://huggingface.co/datasets/Talson/mfv-cntk-resize-overflow-poc.mfv-circle-onert-ignored-verifier-poc
Circle (.circle) Ignored Verifier PoC
CWE-252/CWE-125: BaseLoader discards VerifyModelBuffer() return -> OOB READ
Bug
Samsung/ONE BaseLoader.h:1704 calls VerifyModelBuffer() but discards the boolean return value. Proceeds to parse unverified flatbuffer data. Corrupted vector lengths cause OOB reads.
Variant 1: Inflated tensor shape vector (count 2 -> 0x40000000) -> heap-buffer-overflow READ
Variant 2: Inflated subgraphs vector (count 1 -> 4096) -> SEGV at unmapped… See the full description on the dataset page: https://huggingface.co/datasets/Talson/mfv-circle-onert-ignored-verifier-poc.mfv-openvino-ir-offset-overflow-poc
OpenVINO IR (.xml/.bin) Integer Overflow PoC
CWE-190/CWE-125: offset+size overflow in xml_deserialize_util.cpp -> OOB READ
Bug
XML <data offset="..." size="..."> attributes: offset+size overflows size_t, bounds check passes. Pointer goes OOB.
4 instances:
Main constant path (line 895) -> SEGV
String tensor path (line 828) -> heap-buffer-overflow READ
shape_size unsafe multiply (line 904) -> validation bypass (safe version exists but unused!)
Preprocessing mean… See the full description on the dataset page: https://huggingface.co/datasets/Talson/mfv-openvino-ir-offset-overflow-poc.