GGUF RWKV tokenizer NUL-chain OOB read PoC

This repository proves a narrow claim: loading a crafted RWKV GGUF whose vocabulary contains a token that decodes to A followed by a long run of NUL bytes triggers a stack-buffer-overflow during prompt tokenization in llama.cpp.

• What this PoC shows:

- the attacker controls GGUF tokenizer vocabulary entries

- the model reaches the normal vocabulary-loading path

- tokenizing the prompt "A" causes native code to read past the end of the prompt buffer

• What this PoC does not show:

- code execution

- arbitrary file read or write

- a broader bug affecting non-RWKV tokenizer types

• Verified commit:

- 95e5254c0ae93529b2f6c05e210b9cac5c0070fc

Files

• build_malicious_rwkv_null_chain.py: helper to generate rwkv-null-chain-oob.gguf
• poc_vocab_tokenize_loader.cpp: minimal vocab-loading and tokenization harness using product code
• build_stubs.cpp: small helper stubs needed by the reduced harness build

SHA-256 of the generated rwkv-null-chain-oob.gguf artifact:

• b085b41d9621ff782ab015dacee61694183d3c45a2ae362964058fa739654c7f

Generate the malicious GGUF

python3 build_malicious_rwkv_null_chain.py

That helper writes a metadata-only GGUF with:

• general.architecture = "rwkv"
• tokenizer.ggml.model = "rwkv"
• tokenizer.ggml.tokens = ["A\\x00\\x00\\x00...","\\n"]

The long \x00 chain is intentional. The RWKV tokenizer unescapes those bytes before building its trie, so tokenizing "A" walks through the implicit NUL terminator and then farther past the prompt buffer.

Reproduce

Build a small ASAN/UBSAN-instrumented loader from product sources together with poc_vocab_tokenize_loader.cpp and build_stubs.cpp, then run:

ASAN_OPTIONS=detect_leaks=0 \
./poc_rwkv_tokenize_loader ./rwkv-null-chain-oob.gguf

The expected result is an AddressSanitizer report showing:

• ERROR: AddressSanitizer: stack-buffer-overflow
• READ of size 1
• a stack including llm_tokenizer_rwkv_session::tokenize

Notes

This PoC intentionally stays on the narrow RWKV embedded-NUL trie-walk issue. It does not claim a broader bug in every GGUF tokenizer implementation.