stable-diffusion.cpp: Out-of-bounds Read in PyTorch Checkpoint Parsing
Overview
Versions of stable-diffusion.cpp prior to master-584-0a7ae07 are susceptible to an out-of-bounds read vulnerability stemming from improper handling of PyTorch checkpoint (.ckpt) file parsing. The pickle parser, specifically within `src/model.cpp`, fails to adequately validate remaining input buffer size before reading opcode arguments or advancing the parser's internal buffer pointer. Maliciously crafted or truncated .ckpt files can exploit this by causing the parser to read data beyond the allocated buffer's boundaries when advancing the pointer using expressions like `buffer += N`. This is because the condition `buffer + N <= buffer_end` is not consistently checked. Consequently, reading from a malformed checkpoint can lead to memory corruption or denial-of-service conditions. This vulnerability was discovered using LibFuzzer with malformed checkpoint inputs and can be triggered by applications loading untrusted .ckpt model files. The primary attack vector involves users or applications loading .ckpt files from potentially compromised sources, such as unofficial model repositories.
Affected Systems
Testing Guide
* Create or obtain a malformed/truncated .ckpt file designed to trigger the out-of-bounds read. * Attempt to load this crafted .ckpt file using a version of stable-diffusion.cpp prior to master-584-0a7ae07. * Monitor the application for crashes, memory access violations, or unexpected behavior. * Alternatively, verify that versions equal to or greater than master-584-0a7ae07 correctly reject or handle the malformed file without errors.
Mitigation Steps
* Ensure stable-diffusion.cpp is updated to version master-584-0a7ae07 or later. * Avoid loading .ckpt checkpoint files from untrusted or unknown sources. * Prefer using model formats like `.safetensors` which are generally considered safer. * Implement strict input validation and sanitization for any loaded checkpoint files if upgrading is not immediately feasible. * If possible, run applications loading models in a sandboxed environment.
Patch Details
master-584-0a7ae07