| عنوان | ggml-org llama.cpp confirmed commit e15efe0 CWE-617 (Reachable Assertion) |
|---|
| الوصف | ## Summary
The jinja parser constructs a `filter_expression` without validating the pipe `|` operand type. When the operand is a literal (e.g., integer `9`), the `chk_type` assertion fires → `abort()`. 7-byte payload (`{{9|9|{`). Reachable if server processes user-specified `chat_template` parameters.
---
## Exploit / PoC
**File:** `poc-020-jinja-assert-abort.bin` (7 bytes: `{{9|9|{`)
**Reproduction:**
```
Input: {{9|9|{
→ chk_type assertion failed in runtime.h:126
→ abort()
```
---
## Suggested Fix
Validate filter operand type in `parse_filter_expression()`.
---
## Discovery
- **Tool:** Crucible fuzzer (jinja campaign)
- **Date:** 2026-04-03
- **Confirmed on:** llama.cpp commit e15efe0, Fedora 43 x86_64 |
|---|
| المصدر | ⚠️ https://drive.proton.me/urls/R8D8NGZ6Z0#C2cVZYn5z1Xc |
|---|
| المستخدم | m00dy (UID 97162) |
|---|
| ارسال | 07/04/2026 09:23 PM (4 أشهر منذ) |
|---|
| الاعتدال | 02/08/2026 08:58 PM (4 months later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 385409 [ggml-org llama.cpp e15efe0 Jinja Minja Template Parser common/jinja/parser.cpp الحرمان من الخدمة] |
|---|
| النقاط | 20 |
|---|