From 69788e0d23d83658bc8640cd220394d6f030f454 Mon Sep 17 00:00:00 2001 From: Georgi Gerganov Date: Thu, 19 Feb 2026 15:59:09 +0200 Subject: [PATCH] ggml : fix int overflows in ggml_new_object() --- ggml/src/ggml.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/ggml/src/ggml.c b/ggml/src/ggml.c index ed819eaa4c..200899936d 100644 --- a/ggml/src/ggml.c +++ b/ggml/src/ggml.c @@ -1634,6 +1634,16 @@ static struct ggml_object * ggml_new_object(struct ggml_context * ctx, enum ggml char * const mem_buffer = ctx->mem_buffer; struct ggml_object * const obj_new = (struct ggml_object *)(mem_buffer + cur_end); + // integer overflow checks + if (cur_end > SIZE_MAX - size_needed) { + GGML_LOG_WARN("%s: overflow detected in cur_end + size_needed\n", __func__); + return NULL; + } + if (cur_end + size_needed > SIZE_MAX - GGML_OBJECT_SIZE) { + GGML_LOG_WARN("%s: overflow detected in cur_end + size_needed + GGML_OBJECT_SIZE\n", __func__); + return NULL; + } + if (cur_end + size_needed + GGML_OBJECT_SIZE > ctx->mem_size) { GGML_LOG_WARN("%s: not enough space in the context's memory pool (needed %zu, available %zu)\n", __func__, cur_end + size_needed + GGML_OBJECT_SIZE, ctx->mem_size);