Integer Overflow in llama.cpp LLaMA-Android JNI Wrapper new_1batch()

This repository is a compact proof-of-concept set for CVE-2026-70638, an integer overflow in llama.cpp Android JNI batch allocation logic. It is not a full weaponized exploit; instead it demonstrates exploitability conditions and attacker control over the vulnerable multiplicands used in unchecked malloc size calculations. Repository structure: - README.md: documents the vulnerability, affected versions, usage, and references. - overflow_demo.c: standalone arithmetic reproducer showing how sizeof(llama_seq_id) * n_seq_max wraps on 32-bit Android (armeabi-v7a), causing an undersized allocation relative to intended write size. It explicitly avoids performing an out-of-bounds write. - craft_gguf.py: generates a minimal metadata-only GGUF file with attacker-controlled llama.embedding_length. This demonstrates the file-based delivery vector where untrusted model metadata influences the embd parameter consumed by the vulnerable JNI function. - hook_new_batch.js: Frida instrumentation script for live-device research. It locates the JNI export Java_android_llama_cpp_LLamaAndroid_new_1batch in likely native libraries, hooks it, logs n_tokens/embd/n_seq_max, and can override them to force the overflow path during testing. Main exploit capabilities: - Demonstrates the vulnerable allocation arithmetic and 32-bit wraparound behavior. - Crafts a malicious GGUF artifact to supply attacker-controlled metadata into the vulnerable code path. - Hooks the live JNI boundary to inspect and optionally modify exploit-relevant parameters. Attack surface and purpose: - Primary vector is file-based/local: a malicious GGUF model file influences metadata parsed by an affected Android llama.cpp integration. - Secondary vector is local dynamic instrumentation via Frida for research validation. - The PoC targets Android JNI bindings in llama.cpp builds b1886-b7445; practical heap corruption is emphasized for 32-bit ABIs, while 64-bit behavior is described as large allocation failure/DoS rather than wraparound heap corruption. Overall, this is a credible research PoC repository focused on demonstrating input control and arithmetic conditions behind the vulnerability, not on delivering a post-exploitation payload or automated compromise chain.