Repository navigation
ggml: fix size wrap in allocator and gguf alignment read - #26318
Ghost-Silver wants to merge 1 commit into
Conversation
github-actions
Bot
added
testing
|
Hi @Ghost-Silver, thanks for your contribution! Per our contribution guidelines, the automated PR checker found the following issue(s) that need your attention:
Please note that maintainers reserve the right to make final decisions on PRs. If you believe there is a mistake, please comment below. |
@ggml-gh-bot 感谢提醒。 |
|
Subject: Request to create private Security Advisory and coordinate CVE for allocator overflow (PR #26318) Hello maintainers — I discovered an integer wrap in ggml_tallocr_alloc that can cause out-of-bounds writes when loading crafted GGUF data. I have opened PR #26318 which includes fixes and two regression tests; PoC and tests are available. Summary of impact: A size wrap in the allocator can lead to allocations smaller than intended and subsequent out-of-bounds writes when processing specially crafted GGUF files. This affects the allocator code in the repository and may be exploitable when processing untrusted model files. Could the maintainers please create a private GitHub Security Advisory for this issue and coordinate CVE allocation on behalf of the project (or advise the preferred route)? PR: #26318 Thank you, and please let me know how you wish to proceed. |
- ggml-alloc: validate that alignment is a non-zero power of two before using GGML_PAD, preventing undefined behavior if assertions are disabled or the allocator is misconfigured. - ggml-alloc: check for allocation size overflow before GGML_PAD and reject zero-size allocations, returning GGML_STATUS_FAILED instead of aborting. Prevents heap out-of-bounds writes from malformed tensor dimensions. - test-alloc: add regression test test_tallocr_alloc_overflow.
4e8102e to
25add14
Compare
|
English only and any GGUF issues should be caught in |
2 participants
Overview
我在 fuzzing GGUF 加载器时发现一个问题：分配器返回成功，但后续写入会覆盖相邻 tensor 的数据。
追查后发现是 里的 宏在做 __TEXT __DATA __OBJC others dec hex 时溢出了。当 size 接近最大值时，加法回绕成很小的数，导致分配了太小的 buffer，但 tensor 元数据仍以为 size 很大，结果越界。
这个和之前修过的 GHSA-vgg9 不是同一个问题——那个在 GGUF 解析层，这个在更底层的分配器 ，所以之前的补丁没覆盖到。
我的改法：
(注：原先提交中顺带处理的 类型校验已在上游通过 #25596 独立合入，本次 rebase 后已尊重上游实现，本 PR 聚焦解决尚未被上游覆盖的 整数溢出缺陷)
Requirements