llamacpp-clip-audio-chunk-int-overflow-poc

PoC: llama.cpp clip.cpp Granite-Speech audio_chunk_size int-overflow heap OOB write (malicious GGUF mmproj)

Target: ggml-org/llama.cpp — tools/mtmd/clip.cpp (Granite-Speech audio projector). Format: GGUF (mmproj / multimodal audio projector) — huntr high-value format. Class: CWE-190 integer overflow → CWE-787 heap out-of-bounds write. Verified: source @ 665892536dfb1b7532161e3182304bd35c33e768; SIGSEGV reproduced (CRASH_PROVEN.md).

What it is

clip.audio.chunk_size is read from the GGUF mmproj metadata into int context_size and is never bounds-checked. In the Granite-Speech audio encode path (clip.cpp:4334):

const int context_size = ctx->model.hparams.audio_chunk_size;
std::vector<int32_t> dists(context_size * context_size);      // int*int -> 32-bit overflow
for (int i = 0; i < context_size; i++)
    for (int j = 0; j < context_size; j++)
        dists[i * context_size + j] = /* ... */;              // writes context_size^2 entries -> OOB

context_size = 65536 overflows context_size*context_size to 0, so the vector is empty while the loops write ~2^32 entries → heap OOB write with attacker-controlled length. A second sink at clip.cpp:4351 (mask(context_size*context_size*num_blocks)) has the same overflow.

Files

• chunk_size_repro.cpp / chunk_size_repro — isolated reproduction; SIGSEGVs at -O0 (CRASH_PROVEN.md).

Trigger (real llama.cpp)

Set clip.audio.chunk_size = 65536 on a Granite-Speech mmproj GGUF and process any audio: llama-mtmd-cli -m <granite-speech-text>.gguf --mmproj <evil-mmproj>.gguf --audio any.wav -p "transcribe".

Coordinated-disclosure security PoC for the huntr AI/ML bug-bounty program. No payload.