msgpack-c (msgpack/msgpack-c) unbounded allocation PoC

Proof-of-concept file for a huntr Model Format Vulnerability report against msgpack/msgpack-c (c_master branch, the C reference implementation of MessagePack, used directly via its public C API - not the Python bindings, which add their own separate max_array_len/max_map_len safety limits not present in the raw C library).

evil.msgpack is a 5-byte file: the array32 marker (0xdd) followed by a 4-byte big-endian count of 0xFFFFFFFF (4,294,967,295 elements).

template_callback_array (src/unpack.c + unpack_template.h) takes n directly from the MSGPACK_CS_ARRAY_32 header (a raw uint32 from the input bytes) and computes size_t size = n * sizeof(msgpack_object); -> msgpack_zone_malloc(size). The only guard present (#if SIZE_MAX == UINT_MAX) only applies on 32-bit builds; on 64-bit builds there is no check at all. The maintainer left a /* FIXME security guard */ comment directly on this line, acknowledging the gap.

Verified live: compiled src/unpack.c/objectc.c/zone.c/version.c directly from a fresh c_master clone with gcc -O0 (generated sysdep.h/pack_template.h from the repo's own cmake/*.in templates, substituting the little-endian values for this host - no functional code was modified), then called msgpack_unpack_next() directly on the 5-byte buffer under a 1.5GB ulimit -v cap:

ret=-2   (MSGPACK_UNPACK_NOMEM_ERROR)

This confirms the library attempts an allocation proportional to the declared 4.29-billion-element count from a 5-byte input, and fails cleanly under memory pressure (a DoS/OOM-class finding - malloc failure is handled without falling into undefined behavior, not a heap-overflow class bug).

Reachable via msgpack_unpack_next(), the library's documented public unpacking entry point (per its own QUICKSTART-C.md examples) - not test-only or internal code. No SECURITY.md exists on the repository.

Impact: Denial of Service - an attacker who can supply or influence a MessagePack-encoded input parsed directly with msgpack-c's C API can force a request to allocate tens of gigabytes from a 5-byte payload.

Downloads last month

-

Downloads are not tracked for this model. How to track
Inference Providers NEW
This model isn't deployed by any Inference Provider. 🙋 Ask for provider support