hank-ai darknet improperly calculates convolutional layer weight and output buffer sizes by multiplying configuration parameters from a .cfg file using unchecked 32-bit integer arithmetic. Specifically, l.nweights is computed as (c / groups) * n * size * size and l.outputs as l.out_h * l.out_w * l.out_c, both feeding directly into xcalloc. If the product of these dimensions exceeds INT_MAX, the value wraps around to a small or zero number, resulting in undersized buffer allocations. The forward_convolutional_layer function then recalculates GEMM dimensions with a different operand order, causing reads and writes beyond the allocated buffer boundaries. Loading a crafted .cfg file alone is sufficient to trigger this out-of-bounds access, leading to heap buffer overflow and glibc allocator metadata corruption as observed under AddressSanitizer and in release builds.

The integer overflow causes heap buffer allocations to be smaller than required, leading to out-of-bounds memory reads and writes during convolutional layer processing. This can corrupt heap metadata and potentially destabilize or crash the application. The vulnerability requires only loading a maliciously crafted .cfg file, making it a high-risk issue for denial of service or potential memory corruption exploitation. No valid weights file is needed to trigger the flaw.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid loading untrusted or crafted .cfg files that specify convolutional layer dimensions large enough to cause integer overflow. Monitor vendor communications for patches or updates addressing this issue.