Karthik-Gowda/safetensors-oob-dos-poc

safetensors validate() OOB DoS PoC

CVE: Pending (reported via Huntr MFV)
Severity: Medium (CVSS 5.3)
Affected: huggingface/safetensors — tensor.rs:615 (validate() discards buffer_end), tensor.rs:454,472,497 (OOB slice)

Vulnerability

metadata.validate()? at tensor.rs:615 discards the buffer_end return value, skipping the buffer-length check present on the main path. A subsequent slice self.data[offset.0..offset.1] where offset.1 > self.data.len() causes a Rust OOB index panic → SIGABRT on the Python process.

PoC File

safetensors_oob_dos_poc.safetensors — header claims 1,000,000 bytes of tensor data; only 10 bytes are present.

from safetensors import safe_open
# On the safe (main) path: raises MetadataIncompleteBuffer
# On the line-615 alternate path: OOB panic -> process abort
t = safe_open("safetensors_oob_dos_poc.safetensors", framework="numpy")

Fix

// tensor.rs:615 — replace discarded validate() with buffer_end check:
let buffer_end = metadata.validate()?;
if buffer_end != data.len() {
    return Err(SafeTensorError::MetadataIncompleteBuffer);
}