s1ko/whisper-cpp-ggml-ndims-oob-poc

whisper.cpp GGML model-file — stack out-of-bounds write PoC (CWE-787 / CWE-121)

Security-research proof-of-concept for an out-of-bounds stack write in whisper.cpp's whisper_model_load triggered by loading a crafted GGML (.bin / .ggml) model file. Affects ggml-org/whisper.cpp at HEAD fc674574ca27cac59a15e5b22a09b9d9ad62aafe (the bundled legacy ggml loader). Loading alone triggers it — no inference required.

Each tensor record in a GGML model carries an attacker-controlled 32-bit dimension count n_dims, used directly as the bound of a loop that writes into a fixed int32_t ne[4] stack array, with no clamp to 4 / GGML_MAX_DIMS (src/whisper.cpp:1884-1887). A record with n_dims > 4 writes attacker-supplied 4-byte values past the end of ne[] onto the stack.

File

• evil-whisper-ndims.bin — a valid GGML whisper header (built from the shipped for-tests-ggml-tiny.en.bin fixture) followed by one malicious tensor record with n_dims = 0x40000000.

Reproduce

# in a whisper.cpp checkout, built with AddressSanitizer:
cmake -B build-asan -DWHISPER_SANITIZE_ADDRESS=ON -DCMAKE_BUILD_TYPE=Debug
cmake --build build-asan --target whisper-cli -j
./build-asan/bin/whisper-cli -m evil-whisper-ndims.bin -f samples/jfk.wav
# => AddressSanitizer: SEGV in whisper_model_load at src/whisper.cpp:1886
#    reached from whisper_init_from_file_with_params (the standard model-load API)

Reported via coordinated disclosure (huntr.com). Researcher: s1ko (github.com/s1ko).