提交 #908271: ggml-org llama.cpp master e9fa0781f Assertion

The ggml-rpc server in llama.cpp does not validate tensor dimensions received from the network before using them.

rpc_server::deserialize_tensor() in ggml/src/ggml-rpc/ggml-rpc.cpp checks that the tensor type is within range and that its block size is not zero, then passes tensor->ne[0] straight to ggml_new_tensor_4d(). It never checks that ne[0] is a multiple of the block size for that type.

For a quantized type such as Q4_0 the block size is 32. ggml_row_size() in ggml/src/ggml.c contains assert(ne % ggml_blck_size(type) == 0) at line 1341. A tensor that declares a quantized type with ne[0] not a multiple of the block size reaches that assertion and the server process aborts with SIGABRT.

deserialize_tensor() is reached from the SET_TENSOR, GET_TENSOR, SET_TENSOR_HASH, INIT_TENSOR, COPY_TENSOR and GRAPH_COMPUTE commands. The rpc-server binary listens on a TCP port and the protocol carries no authentication, so any client that can reach the port can terminate the server with a single message. No model file or local access is involved.

The wire format is a one byte command, an eight byte little endian message size, and the message body. The rpc_tensor struct is sent as raw bytes, so ne[0] is directly attacker controlled.

Still present on master at commit e9fa0781f, checked 2026-07-28. The type range check and the block size zero check are both present in deserialize_tensor(); the ne[0] alignment check is not.

This is distinct from the ggml-rpc issues already recorded elsewhere: it is the dimension validation path in deserialize_tensor(), not op dispatch and not the unbounded resize in recv_msg().

Reported publicly at https://github.com/ggml-org/llama.cpp/issues/25288, which is open and unfixed.

• 来源: ⚠️ https://github.com/ggml-org/llama.cpp/issues/25288
• 用户: m00dy (UID 97162)
• 提交: 2026-07-29 03時41分 (1 月前)
• 管理: 2026-09-07 07時17分 (1 month later)
• 状态: 已接受
• VulDB条目: 399508 [ggml-org llama.cpp 直到 0.4.0 RPC Server ggml-rpc.cpp deserialize_tensor ne 拒绝服务]
• 积分: 20