caffe-oom-poc

Caffe CWE-789: OOM DoS via INT_MAX Boundary Case in Blob::Reshape()

Status: CONFIRMED — READY TO SUBMIT

Severity: High (P2) — Denial of Service

Target

• Repo: BVLC/caffe
• Platform: huntr.com
• Format: .caffemodel (protobuf)

Root Cause

The overflow guard in Blob::Reshape() has a boundary condition that allows INT_MAX through:

// src/caffe/blob.cpp:26-28
CHECK_LE(shape[i], INT_MAX / count_);  // count_=1: INT_MAX <= INT_MAX → PASSES
count_ *= shape[i];                    // count_ = 2,147,483,647

// blob.cpp:34-35
data_.reset(new SyncedMemory(capacity_ * sizeof(Dtype)));  // ~8 GB — NO CAP
diff_.reset(new SyncedMemory(capacity_ * sizeof(Dtype)));  // ~8 GB — NO CAP

Total allocation attempt: ~16 GB → std::bad_alloc / OOM-kill.

Trigger Path

caffe.Net('deploy.prototxt', 'caffe_oom.caffemodel', caffe.TEST)
  → Net::CopyTrainedLayersFrom()         [net.cpp:991]
  → Blob::FromProto(proto, reshape=true) [blob.cpp:285]
  → Blob::Reshape(vector<int>)           [blob.cpp:21]
  → new SyncedMemory(8,589,934,588)      [blob.cpp:35]
  → CaffeMallocHost(8589934588)
  → malloc() → ENOMEM → std::bad_alloc → SIGABRT

Vulnerable Files

PoC Files

• poc_caffe_oom.py — builds caffe_oom.caffemodel and documents trigger
• caffe_oom.caffemodel — generated by script

Reproduction

python poc_caffe_oom.py
# With caffe bindings:
import caffe
caffe.Net('deploy.prototxt', 'caffe_oom.caffemodel', caffe.TEST)

Fix

constexpr int64_t kMaxBlobCount = 1LL << 28;  // 256M elements
CHECK_LE(count_, kMaxBlobCount) << "blob size exceeds safe limit";