igfray/minicpmv-bucket-coords-stack-overflow-poc

llama.cpp MiniCPM-V — stack buffer overflow via bucket_coords PoC (coordinated disclosure)

This repository contains a security-research proof-of-concept file, not a machine-learning model. test_extreme_ar.png is a crafted extreme-aspect-ratio image (52800x44) that triggers a stack-based buffer overflow in llama.cpp at tools/mtmd/clip.cpp:3690 (bucket_coords_w[i] OOB write in clip_image_batch_encode). It is published solely so the huntr triage team and the llama.cpp / ggml-org maintainers can reproduce the issue during coordinated disclosure.

• Impact: Stack buffer overflow write on image encoding (memory corruption / DoS). Written values constrained to [0, 69]. CVSS 4.0: 5.3 (Medium).
• Affected: llama.cpp master @ 00fa7cb284cbf133fc426733bd64238a3588a33e and current master (guard still absent as of this writing).
• Trigger: requires two unmodified public models from openbmb/MiniCPM-V-2_6-gguf: mmproj-model-f16.gguf and ggml-model-Q4_K_M.gguf. Then run:

  llama-mtmd-cli --mmproj mmproj-model-f16.gguf -m ggml-model-Q4_K_M.gguf \
    --image test_extreme_ar.png -p "What is in this image?" -c 2048 -n 1
  

  Build with -DLLAMA_SANITIZE_ADDRESS=ON to see the ASAN report.
• Inert otherwise — the payload is a plain PNG image; it executes no code and only affects a process that deliberately processes it with a vulnerable llama.cpp + MiniCPM-V projector.

How it works

The MiniCPM-V mmproj has patch_size=14 and image_size=448. After aspect-ratio-preserving preprocessing (get_best_resize), the 52800x44 image (aspect ratio 1200:1) is resized to approximately 15519x13 pixels. This gives pos_w = 15519 / 14 = 1108, which exceeds the fixed int bucket_coords_w[1024] stack array, causing an OOB write.

Files

File	Purpose
test_extreme_ar.png	Crafted 52800x44 PNG that overflows bucket_coords_w[1024] after preprocessing

Required models (not included — public, unmodified)

Model	Source
mmproj-model-f16.gguf	openbmb/MiniCPM-V-2_6-gguf
ggml-model-Q4_K_M.gguf	openbmb/MiniCPM-V-2_6-gguf