---

license: mit

---

gguf-parser-go (gpustack) integer-overflow panic PoC

Proof-of-concept file for a huntr Model Format Vulnerability report against

gpustack/gguf-parser-go (Go, used by GPUStack, a cluster manager for

LLMs, to estimate VRAM/resources from GGUF files - including parsing remote

files from HuggingFace/ModelScope/Ollama).

evil.gguf is a 44-byte file: GGUF magic, version 3, tensor_count=0,

metadata_kv_count=1, then a single KV key declaring a string length of

0x8000000000000000 (2^63).

_GGUFReader.ReadString() (file.go:1574-1592) reads a uint64 length

directly from the file with no upper bound and passes it to

bytex.GetBytes(l) (util/bytex/pool.go:25-37), where s := int(size[0]) -

on a 64-bit platform, converting a uint64 >= 2^63 to int produces a

NEGATIVE number. cap(buf) >= s is trivially true (positive >= negative),

so buf[:s] with a negative index causes an uncaught runtime panic

(process crash).

Verified live (Go 1.22.5, fresh clone, commit 8dc7a62):

panic: runtime error: slice bounds out of range [:-9223372036854775808]
.../util/bytex.GetBytes(...)      pool.go:36
.../gguf-parser-go._GGUFReader.ReadString(...)  file.go:1585
.../gguf-parser-go._GGUFMetadataReader.Read(...) file.go:1782
.../gguf-parser-go.parseGGUFFile(...)  file.go:428
.../gguf-parser-go.ParseGGUFFile(...)  file.go:309

Independently reproduced twice: once directly, and once by a separate

blind-adversarial review (its own fresh clone and build) instructed to

actively look for reasons this would NOT crash - both runs hit the

identical panic trace.

A neighboring sibling function, SkipReadingString(), was hardened against

this exact overflow class by commit d205869 ("fix: integer overflow in

tensor elements/bytes calculation", 2026-05-27) via a new safeSeekDelta()

helper - but ReadString() (the real-read counterpart, not the skip path)

was not covered by that fix.

Reachable via the sole exported entry point ParseGGUFFile() -

_GGUFMetadataReader.Read() calls ReadString() as the very first action

for every metadata key, and _GGUFTensorInfoReader.Read() does the same for

every tensor name - this triggers on the first KV field of any GGUF file,

not an obscure side path.

Impact: Denial of Service - an attacker who can supply or influence a GGUF

file (including remote files fetched by GPUStack) can crash the parsing

process with a 44-byte file.