diff --git a/ggml/src/gguf.cpp b/ggml/src/gguf.cpp index 5c26f751f..8e8c2f0e6 100644 --- a/ggml/src/gguf.cpp +++ b/ggml/src/gguf.cpp @@ -792,7 +792,16 @@ static struct gguf_context * gguf_init_from_reader(const struct gguf_reader & gr gguf_free(ctx); return nullptr; } - size_t padded_size = GGML_PAD(ggml_nbytes(&ti.t), ctx->alignment); + const size_t nbytes = ggml_nbytes(&ti.t); + // GGML_PAD adds (alignment - 1) to nbytes. when nbytes is near + // SIZE_MAX this wraps to 0 and makes the check below dead. + if (nbytes > SIZE_MAX - (ctx->alignment - 1)) { + GGML_LOG_ERROR("%s: tensor '%s' size %zu overflows after padding (alignment %zu)\n", + __func__, ti.t.name, nbytes, ctx->alignment); + gguf_free(ctx); + return nullptr; + } + const size_t padded_size = GGML_PAD(nbytes, ctx->alignment); if (SIZE_MAX - ctx->size < padded_size) { GGML_LOG_ERROR("%s: tensor '%s' size overflow, cannot accumulate size %zu + %zu\n", __func__, ti.t.name, ctx->size, padded_size);