safetensors-h-metadata-oob-write-poc

safetensors.h — Heap OOB Write via unbounded __metadata__ (CWE-787)

Proof-of-concept for a heap out-of-bounds write in hsnyder/safetensors.h (a single-header C .safetensors reader), triggered when parsing an untrusted .safetensors file whose __metadata__ object has more than 100 keys. Library: hsnyder/safetensors.h, function safetensors_file_init() at safetensors.h:681. Class: CWE-787 out-of-bounds write / CWE-122 heap buffer overflow. Format: SafeTensors (.safetensors).

Root cause

safetensors_more_memory() grows the metadata[] array by +100 once per top-level header entry, but the __metadata__ inner key/value loop appends out->metadata[out->num_metadata++] per key with no capacity check. Capacity is fixed at 100, so the 101st key writes past the 3200-byte (100 x 32) allocation. Guard-asymmetry: the sibling shape list append IS bounded (== SAFETENSORS_MAX_DIM, line 428); the __metadata__ append is not.

Files

poc_101.safetensors.base64 is the malicious model (base64 of a 1220-byte fully-valid .safetensors with 101 metadata keys). Decode with base64 -d poc_101.safetensors.base64 > poc_101.safetensors.

Confirmation

AddressSanitizer (exact-size heap buffer): 100 keys parses cleanly; 101 keys give heap-buffer-overflow WRITE at safetensors.h:681, 0 bytes after the 3200-byte allocation (metadata[100]). Stock glibc (non-ASAN): the 101-key file corrupts adjacent chunk metadata, giving malloc(): invalid size then SIGABRT (deterministic real heap corruption). 100 keys is a clean control (non-vacuous).

Honest scope

Confirmed: OOB heap write plus DoS / heap corruption. Each overflowing 32-byte entry has two fully attacker-controlled 32-bit len fields; the two ptr fields point into the attacker file buffer (not arbitrary addresses). RCE is argued (known primitive) but NOT demonstrated. Caveats: low-adoption library (~8 stars), independent C implementation (not the official safetensors), last commit 2025-06-08. Full write-up is in the huntr report. Fix: call safetensors_more_memory() before the __metadata__ append.