hank-ai/darknet CWE-190/CWE-770 unbounded allocation PoC
Proof-of-concept files for a huntr Model Format Vulnerability report against hank-ai/darknet (.cfg convolutional-layer parser).
evil.cfg is a 93-byte darknet config file declaring filters=700000000 in a
[convolutional] section.
parse_convolutional_section() (src-lib/darknet_cfg.cpp:1415-1417) reads
filters/size/groups as plain int with no upper bound. These flow
directly into convolutional_layer.cpp:764:
l.nweights = (c / groups) * n * size * size; (plain int32, no overflow
guard), then convolutional_layer.cpp:781:
l.weights = (float*)xcalloc(l.nweights, sizeof(float)); - no sanity-check
before allocating. .cfg is parsed strictly before the .weights file is
even opened (src-python/darknet.py -> load_network_custom ->
parse_network_cfg_custom then load_weights), so a crafted .cfg file
alone (no weights file needed) reaches this code path.
repro.cpp reproduces the exact arithmetic and allocation call in isolation
(full libdarknet needs OpenCV/CUDA, not built here) - verified live on this
host:
c=3, n(filters)=700000000, size=3, groups=1
l.nweights (int32, overflowed) = 1720130816 (true value 18,900,000,000 wraps)
calloc(1720130816, 4) -> NULL on this host -> darknet's calloc_error() ends in
an uncatchable std::abort()
Impact: Denial of Service - an attacker who can supply or influence a .cfg
file (the standard first input, parsed before any weight data) can crash the
loading process via abort().