Christauff/gguf-pad-overflow-poc

GGML_PAD Integer Overflow PoC

Security research PoC for responsible disclosure. Integer overflow in GGML_PAD macro in llama.cpp GGUF parser (CWE-190).

Files

• overflow_poc.gguf — 2-tensor variant (intra-allocation OOB)
• overflow_poc_v2.gguf — Single-tensor variant (NULL deref, ASAN-confirmed)
• poc.py — Generator script with arithmetic proof

Reproduction

git clone https://github.com/ggerganov/llama.cpp && cd llama.cpp
cmake -B build -DBUILD_SHARED_LIBS=OFF
cmake --build build --target llama-gguf
./build/bin/llama-gguf overflow_poc.gguf r n

Tested against commit b8635075f (2026-04-04).