caffe-poc-blobshape-int64-truncation-2026-05-12

Caffe BlobShape int64 Truncation PoC

PoC for huntr submission against BVLC/caffe + opencv/opencv (Caffe DNN importer).

Vulnerability

BlobShape.dim is a protobuf int64 in Caffe's model schema, but both BVLC/caffe and OpenCV DNN narrow it to C++ int before range validation. A serialized dimension like 4294967297 (2^32 + 1) is silently truncated to 1 and the forward pass succeeds — the model executes with a topology different from what the serialized model declares.

• CWE-681 Incorrect Conversion between Numeric Types
• CWE-20 Improper Input Validation
• CVSS 3.1: 5.5 Medium (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
• Model integrity is broken: model file declares shape A, runtime executes with shape B. ML multiplier eligible.

Affected versions

• BVLC/caffe 9b89154 (master, 2020-02-13)
• opencv/opencv e640a9b (4.x, 2026-05-12)

Sinks

• BVLC/caffe src/caffe/blob.cpp L48-L54 — Blob::Reshape(const BlobShape&)
• BVLC/caffe src/caffe/blob.cpp L466-L484 — Blob::FromProto()
• OpenCV modules/dnn/src/caffe/caffe_importer.cpp L82-L89 — parseBlobShape()
• OpenCV modules/dnn/src/caffe/caffe_importer.cpp L251-L264, L281-L310 — blobShapeFromProto() / blobFromProto()
• OpenCV modules/dnn/src/caffe/caffe_importer.cpp L393-L400, L438-L443 — text .prototxt input_shape

Reproducer

bash repro.sh
cat /tmp/CAFFE_AUDIT.txt

Expected output:

OpenCV commit: e640a9bfb8649df98903f0165991683a14f605a4
prototxt overflow forward output: 1 7
caffemodel overflow forward output: 1 7

Both malicious models declare dim: 4294967297 but execute with dimension 1.

Files

• repro.sh — full reproducer: clones OpenCV, builds DNN module, compiles driver, generates malicious files, runs forward pass, asserts overflow truncation
• prototxt-overflow.prototxt — text .prototxt form of the malicious model
• caffemodel-overflow.prototxt — text deploy file for binary form
• caffemodel-overflow.caffemodel — binary .caffemodel (31 bytes, valid protobuf)
• driver.cpp + driver-CMakeLists.txt — minimal cv::dnn::readNetFromCaffe() driver

Recommended fix

Reject every BlobShape.dim before narrowing unless 0 <= dim <= INT_MAX, and perform tensor element-count checks in a type wide enough for the serialized dimensions.

Reporter

Reported by lendtrain (huntr) / tonydav41 (HuggingFace). Filed 2026-05-12.