Outmaster/gguf-parser-go-overflow-poc

gguf-parser-go (gpustack) integer-overflow panic PoC

Proof-of-concept file for a huntr Model Format Vulnerability report against gpustack/gguf-parser-go (Go, used by GPUStack, a cluster manager for LLMs, to estimate VRAM/resources from GGUF files - including parsing remote files from HuggingFace/ModelScope/Ollama).

evil.gguf is a 44-byte file: GGUF magic, version 3, tensor_count=0, metadata_kv_count=1, then a single KV key declaring a string length of 0x8000000000000000 (2^63).

_GGUFReader.ReadString() (file.go:1574-1592) reads a uint64 length directly from the file with no upper bound and passes it to bytex.GetBytes(l) (util/bytex/pool.go:25-37), where s := int(size[0]) - on a 64-bit platform, converting a uint64 >= 2^63 to int produces a NEGATIVE number. cap(buf) >= s is trivially true (positive >= negative), so buf[:s] with a negative index causes an uncaught runtime panic (process crash).

Verified live (Go 1.22.5, fresh clone, commit 8dc7a62):

panic: runtime error: slice bounds out of range [:-9223372036854775808]
.../util/bytex.GetBytes(...)      pool.go:36
.../gguf-parser-go._GGUFReader.ReadString(...)  file.go:1585
.../gguf-parser-go._GGUFMetadataReader.Read(...) file.go:1782
.../gguf-parser-go.parseGGUFFile(...)  file.go:428
.../gguf-parser-go.ParseGGUFFile(...)  file.go:309

Independently reproduced twice: once directly, and once by a separate blind-adversarial review (its own fresh clone and build) instructed to actively look for reasons this would NOT crash - both runs hit the identical panic trace.

A neighboring sibling function, SkipReadingString(), was hardened against this exact overflow class by commit d205869 ("fix: integer overflow in tensor elements/bytes calculation", 2026-05-27) via a new safeSeekDelta() helper - but ReadString() (the real-read counterpart, not the skip path) was not covered by that fix.

Reachable via the sole exported entry point ParseGGUFFile() - _GGUFMetadataReader.Read() calls ReadString() as the very first action for every metadata key, and _GGUFTensorInfoReader.Read() does the same for every tensor name - this triggers on the first KV field of any GGUF file, not an obscure side path.

Impact: Denial of Service - an attacker who can supply or influence a GGUF file (including remote files fetched by GPUStack) can crash the parsing process with a 44-byte file.