gguf: reject malformed tensor dims, metadata keys, string lengths, and zero layer counts - #26946
Closed
voidwest wants to merge 1 commit into
Closed
gguf: reject malformed tensor dims, metadata keys, string lengths, and zero layer counts#26946voidwest wants to merge 1 commit into
voidwest wants to merge 1 commit into
Conversation
|
Hi @voidwest, thanks for your contribution! Per our contribution guidelines, the automated PR checker found the following issue(s) that need your attention:
Please note that maintainers reserve the right to make final decisions on PRs. If you believe there is a mistake, please comment below. |
ggml-gh-bot
Bot
added
the
draft
github-actions
Bot
added
ggml
A tensor with a zero dimension (e.g. shape [4, 0]) passes the existing negative-dimension check and then divides by zero in the size-representability check (INT64_MAX / ne[1] with ne[1] == 0), killing the process with SIGFPE inside gguf_init_from_file_impl with no error message. Reject non-positive dimensions with a structured error (GGUF tensors must have positive dimensions; no compliant writer emits zeros). Verified: 96-byte reproducer (header + one tensor info, dims [4, 0]) now fails with "tensor 't.weight' dimension 1 must be positive, got 0" instead of SIGFPE; valid models load unchanged.
voidwest
force-pushed
the
fix/gguf-malformed-input-validation
branch
from
August 12, 2026 06:42
ba7af6c to
7974054
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Overview
gguf_init_from_file_impldies with SIGFPE (integer division by zero,no error message) when a GGUF tensor declares a zero dimension, e.g.
shape [4, 0]: the negative-dimension check passes, then
INT64_MAX / ne[1]divides by zero in the size-representability check.A 96-byte file (header + one tensor info, dims [4, 0]) crashes the
process on load. This PR rejects non-positive dimensions with a
structured error.
Also verified against current master while preparing this PR: two
related findings from the same differential-fuzzing campaign are
already fixed upstream (empty metadata keys are rejected with an error;
declared string lengths are bounded by
GGUF_MAX_STRING_LENGTHand theremaining file bytes), and
block_count = 0now trips a clearGGML_ASSERT(n_layer_all > 0)instead of the previous opaque abort.This PR therefore contains only the zero-dimension fix, which remains
outstanding.
Repro:
zero_dim(96 bytes): header + one tensor info (n_dims=2,dims=[4,0], dtype=f32). Before: SIGFPE. After:
gguf_init_from_reader: tensor 't.weight' dimension 1 must be positive, got 0.Additional information
Found by differential fuzzing of GGUF loaders (tiny inert reproducers;
crash/availability defect, no memory-safety claim). Also reproduced on
b5998/b5999/b7999. Reports archived at
https://github.com/voidwest/embersec-research (research/embersec/comparative/disclosure/).
Requirements
direction of a human researcher; the human is responsible for all
submitted changes.