Soumettre #908271: ggml-org llama.cpp master e9fa0781f Assertion

The ggml-rpc server in llama.cpp does not validate tensor dimensions received from the network before using them.

rpc_server::deserialize_tensor() in ggml/src/ggml-rpc/ggml-rpc.cpp checks that the tensor type is within range and that its block size is not zero, then passes tensor->ne[0] straight to ggml_new_tensor_4d(). It never checks that ne[0] is a multiple of the block size for that type.

For a quantized type such as Q4_0 the block size is 32. ggml_row_size() in ggml/src/ggml.c contains assert(ne % ggml_blck_size(type) == 0) at line 1341. A tensor that declares a quantized type with ne[0] not a multiple of the block size reaches that assertion and the server process aborts with SIGABRT.

deserialize_tensor() is reached from the SET_TENSOR, GET_TENSOR, SET_TENSOR_HASH, INIT_TENSOR, COPY_TENSOR and GRAPH_COMPUTE commands. The rpc-server binary listens on a TCP port and the protocol carries no authentication, so any client that can reach the port can terminate the server with a single message. No model file or local access is involved.

The wire format is a one byte command, an eight byte little endian message size, and the message body. The rpc_tensor struct is sent as raw bytes, so ne[0] is directly attacker controlled.

Still present on master at commit e9fa0781f, checked 2026-07-28. The type range check and the block size zero check are both present in deserialize_tensor(); the ne[0] alignment check is not.

This is distinct from the ggml-rpc issues already recorded elsewhere: it is the dimension validation path in deserialize_tensor(), not op dispatch and not the unbounded resize in recv_msg().

Reported publicly at https://github.com/ggml-org/llama.cpp/issues/25288, which is open and unfixed.

• La source: ⚠️ https://github.com/ggml-org/llama.cpp/issues/25288
• Utilisateur: m00dy (UID 97162)
• Soumission: 29/07/2026 03:41 (il y a 1 mois)
• Modérer: 07/09/2026 07:17 (1 month later)
• Statut: Accepté
• Entrée VulDB: 399508 [ggml-org llama.cpp jusqu’à 0.4.0 RPC Server ggml-rpc.cpp deserialize_tensor ne déni de service]
• Points: 20