llamacpp-clip-window-size-int-overflow-poc

PoC: llama.cpp clip.cpp DeepSeek-OCR attn_window_size int-overflow heap OOB write (malicious GGUF mmproj)

Target: ggml-org/llama.cpp — tools/mtmd/clip.cpp (multimodal vision projector, PROJECTOR_TYPE_DEEPSEEKOCR/2). Format: GGUF (mmproj / multimodal vision projector) — huntr high-value format. Class: CWE-190 integer overflow → CWE-787 heap out-of-bounds write. Verified: source @ 665892536dfb1b7532161e3182304bd35c33e768; SIGSEGV reproduced (CRASH_PROVEN.md).

What it is

clip.vision.attn_window_size is read from the GGUF mmproj metadata into int window and is never bounds-checked (the sanity block at clip.cpp:1684-1757 validates image_size/patch_size/n_embd/n_merge but not attn_window_size). In the DeepSeek-OCR encode path (clip.cpp:4116):

const int window = hparams.attn_window_size;
std::vector<int32_t> rel_pos_indices_local(window * window);      // int*int -> 32-bit overflow
for (int q = 0; q < window; q++)
    for (int k = 0; k < window; k++)
        rel_pos_indices_local[q * window + k] = q - k + window - 1;   // writes window^2 entries -> OOB

window = 65536 makes window*window overflow int to 0, so the vector is empty while the loops write ~2^32 entries → heap OOB write with attacker-controlled length.

Files

• window_size_repro.cpp / window_size_repro — isolated reproduction of the exact size expression + write loop; SIGSEGVs at -O0 (see CRASH_PROVEN.md).
• patch_window_size.py — sets clip.vision.attn_window_size on a DeepSeek-OCR mmproj GGUF.
• CRASH_PROVEN.md — run output + lldb backtrace + the overflow math.

Trigger (real llama.cpp)

Set clip.vision.attn_window_size = 65536 on a DeepSeek-OCR / DeepSeek-OCR2 mmproj GGUF and run any image through it: llama-mtmd-cli -m <deepseek-ocr-text>.gguf --mmproj <evil-mmproj>.gguf --image any.png -p "ocr". The DeepSeek-OCR encoder builds rel_pos_indices_local(window*window) and overruns it.

Coordinated-disclosure security PoC for the huntr AI/ML bug-bounty program. No payload.