darknet-hankai-transpose-oob-poc

PoC — Integer overflow → heap out-of-bounds write in hank-ai/darknet .weights loader (transpose_matrix)

This repository contains a malicious Darknet model (poc_model.cfg + poc_model.weights) that triggers a heap out-of-bounds write (CWE-190 → CWE-787) in hank-ai/darknet when the model is loaded via the public model-loading API (load_weights / parse_network_cfg_custom).

Loading untrusted pretrained Darknet/YOLO weights is a realistic scenario (users routinely download .cfg+.weights pairs from third parties).

Root cause

src-lib/weights.cpp:

• transpose_matrix(float* a, int rows, int cols) allocates xcalloc(rows * cols, sizeof(float)) (line 326) — rows * cols is computed as a 32-bit int and overflows.
• The transpose loop then writes transpose[y*rows + x] = a[x*cols + y] (line 332) iterating over the real rows/cols, so the write index leaves the undersized buffer → heap OOB write of attacker-controlled floats.
• Reached from load_connected_weights (line 350) ← load_weights_upto (547) ← load_weights (660). rows = l.inputs, cols = l.outputs come from the .cfg; the transpose flag is enabled by the .weights header (major > 1000, line 481) — both attacker-controlled.

In the PoC: connected layer with inputs = 65536, output = 65537 → 65536 * 65537 (mod 2^32) = 65536 → a 256 KiB buffer, then the loop writes past it.

Reproduce

Build hank-ai/darknet with AddressSanitizer (CPU build is enough), then:

# minimal driver calling the real public API:
#   Darknet::Network net = parse_network_cfg_custom("poc_model.cfg", 1, 0);
#   load_weights(&net, "poc_model.weights");
./repro poc_model.cfg poc_model.weights

Observed (ASAN):

ERROR: AddressSanitizer: heap-buffer-overflow ... WRITE of size 4
  #0 transpose_matrix(float*, int, int)  src-lib/weights.cpp:332:26
  #1 load_connected_weights(...)          src-lib/weights.cpp:350
  #2 load_weights_upto(...)               src-lib/weights.cpp:547
  #3 load_weights(...)                    src-lib/weights.cpp:660
0x... is located 0 bytes after 262144-byte region   (calloc at transpose_matrix:326)

make_poc.py regenerates the two files deterministically.

Files

• poc_model.cfg — Darknet config with the overflowing connected layer dimensions.
• poc_model.weights — weights blob with major = 1001 (enables the vulnerable transpose path).
• make_poc.py — generator script.