sr64/poc-darknet-tree-overflow

PoC: Heap buffer overflow in hank-ai/darknet read_tree() (CWE-787 / CWE-120)

Crafted Darknet model config that triggers a heap buffer overflow when loaded.

• evil.cfg — a Darknet network definition whose [softmax] layer sets tree=evil.tree. During config parsing (darknet_cfg.cpp:2038/2198 -> read_tree), Darknet loads the tree file.
• evil.tree — a hierarchy file whose first whitespace-delimited token is 300 bytes (> 255).

In read_tree() (src-lib/tree.cpp:89-91), each line's token is copied into a fixed 256-byte xcalloc buffer via sscanf(line, "%s %d", id, &parent) — the %s has no width limit, so a 300-byte token overflows the heap allocation (controllable overwrite).

Reproduce (AddressSanitizer)

The minimal harness darknet_tree_overflow_harness.cpp vendors read_tree() + fgetl() verbatim from the pinned source:

g++ -fsanitize=address -g -O0 darknet_tree_overflow_harness.cpp -o poc
./poc evil.tree
# ==ERROR: AddressSanitizer: heap-buffer-overflow  WRITE of size 301 ... 0 bytes after 256-byte region

Fix: use a width-limited specifier, e.g. sscanf(line, "%255s %d", id, &parent).