Skip to content

Validate GGUF tensor data bounds - #285

Open
mikemikimike wants to merge 1 commit into
Tiiny-AI:mainfrom
mikemikimike:fix/283-validate-gguf-offset
Open

mikemikimike wants to merge 1 commit into
Tiiny-AI:mainfrom
mikemikimike:fix/283-validate-gguf-offset

Conversation

@mikemikimike

Copy link
Copy Markdown

Summary

  • Validate GGUF tensor data offsets and byte ranges against the model file before loading tensor data.
  • Use the same bounds checks for mmap and non-mmap loading paths.
  • Add a regression test covering valid loading and truncated or overflowing tensor offsets.

Fixes #283

Issue: #283

Tests

  • cmake --build build --config Release -j2
  • ctest --test-dir build --verbose --timeout 900 (19/19 passed)

Signed-off-by: mikemikimike <mikemikimike@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Out-of-bounds read in GGUF model loading: tensor data offsets are not validated against the file size on the default mmap path

1 participant