dev-willbird1936/gguf-plamo2-int32-overflow-poc

llamacpp-06 PoC: PLaMo-2 tokenizer int32 accumulator overflow, heap OOB write

llamacpp06_plamo2_v2_K90_N1026277.gguf selects the PLaMo-2 tokenizer (tokenizer.ggml.model = "plamo2") and defines roughly 1,026,277 vocabulary tokens, each a distinct supplementary-plane Unicode codepoint repeated 90 times. Every one of these tokens is fully self-referential (every suffix is also a prefix of a longer suffix of the same token), so each contributes a large, closed-form number of rows to the tokenizer's internal accounting table during llm_tokenizer_plamo2::build(), which int32_t num_pieces accumulates with no overflow check.

The chosen token count and length make num_pieces wrap past 2^31 down to 2656, so table_.resize(2656, ...) allocates a small buffer while a second pass keeps writing attacker-influenced int32 rows via table_[table_idx][...] with no bounds check on table_idx, corrupting heap memory almost immediately after the second pass starts. This is a heap-buffer-overflow WRITE, not just a crash.

build() runs unconditionally whenever a GGUF declares the plamo2 tokenizer, on every model load, including vocab_only loads with no inference required. Loading this file with any llama.cpp build reproduces the overflow.