From 5d67acd4220d0880a975459255ba71a4bf53ce5d Mon Sep 17 00:00:00 2001 From: Georgi Gerganov Date: Sun, 22 Feb 2026 09:46:54 +0200 Subject: [PATCH] ggml : check int overflow in ggml_new_tensor_impl and ggml_new_object --- ggml/src/ggml.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/ggml/src/ggml.c b/ggml/src/ggml.c index 6b53aae088..5630300e5a 100644 --- a/ggml/src/ggml.c +++ b/ggml/src/ggml.c @@ -1640,6 +1640,7 @@ static struct ggml_object * ggml_new_object(struct ggml_context * ctx, enum ggml const size_t cur_end = cur_offs + cur_size; // align to GGML_MEM_ALIGN + GGML_ASSERT(size <= SIZE_MAX - (GGML_MEM_ALIGN - 1)); size_t size_needed = GGML_PAD(size, GGML_MEM_ALIGN); char * const mem_buffer = ctx->mem_buffer; @@ -1723,6 +1724,8 @@ static struct ggml_tensor * ggml_new_tensor_impl( obj_alloc_size = data_size; } + GGML_ASSERT(GGML_TENSOR_SIZE <= SIZE_MAX - obj_alloc_size); + struct ggml_object * const obj_new = ggml_new_object(ctx, GGML_OBJECT_TYPE_TENSOR, GGML_TENSOR_SIZE + obj_alloc_size); GGML_ASSERT(obj_new);