提交 #906136: Ollama <= 0.17.1 Integer Overflow

A malicious GGUF version 1 model file crashes the Ollama decoder through an integer underflow.

In fs/ggml/gguf.go, the function readGGUFV1String reads a declared string length, copies that many bytes, then unconditionally removes one trailing byte for the null terminator that GGUF version 1 strings are assumed to carry. It calls io.CopyN with the declared length, checks the error, and then calls Truncate with the buffer length minus one.

When the declared length is zero, io.CopyN copies nothing and returns no error, so the error branch does not fire. The buffer length is then zero, and Truncate is called with minus one, which panics and terminates the process.

Nothing validates that a version 1 string is non-empty before the terminator is stripped. A 24 byte file is sufficient to trigger it. Confirmed live on commit 964ea42 on 2026-07-04.

Ollama exposes model creation over its HTTP API, so a crafted model reaching that path crashes the serving process and denies service to all users of that instance. On a purely local framing, where an operator runs ollama create by hand against a file they chose, the impact is limited to that process.

The maintainer confirmed and closed the report, stating it was fixed by pull request 17062 and would ship in the next release. That pull request was merged on 2026-07-06.

• 来源: ⚠️ https://github.com/ollama/ollama/issues/17033
• 用户: m00dy (UID 97162)
• 提交: 2026-07-27 00時14分 (1 月前)
• 管理: 2026-09-06 17時44分 (1 month later)
• 状态: 已接受
• VulDB条目: 399448 [Ollama 直到 0.31.1 GGUF Decoder fs/ggml/gguf.go readGGUFV1String 内存损坏]
• 积分: 20