darknet-weights-heap-overflow-poc

Darknet .weights Integer Overflow -> Heap Buffer Overflow PoC

Vulnerability

Integer overflow in transpose_matrix() (src/parser.c:1087) in Darknet when loading crafted .weights files leads to heap buffer overflow.

CWE: CWE-190 (Integer Overflow) -> CWE-122 (Heap Buffer Overflow)

Root Cause

When a .weights file has major > 1000, transpose flag is set. In transpose_matrix():

• calloc(rows * cols, sizeof(float)) where rows=65536, cols=65537
• 65536 * 65537 = 4,295,032,832 overflows int32 to 65536
• Only 262,144 bytes allocated, but loops write 4,295,032,832 elements

Files

• poc_overflow.weights - Malicious weights file
• poc_overflow.cfg - Network config
• generate_poc.py - PoC generator

Reproduction

1. Build darknet with ASan
2. Create test harness that calls parse_network_cfg() + load_weights()
3. Run with poc_overflow.cfg and poc_overflow.weights
4. ASan reports heap-buffer-overflow in transpose_matrix at parser.c:1091

Impact

Heap memory corruption -> DoS + potential ACE

Affected

pjreddie/darknet, hank-ai/darknet, AlexeyAB/darknet