security: reject malformed model tensors at the untrusted-mirror boundary (C half of #368)

[JustVugg]

What

Minimal, standalone fix for the C model-file trust boundary — the memory-safety half of #368. Colibri loads model dirs + safetensors from mirrors it doesn't control, so the file's declared shapes and byte spans are attacker-influenced input.

Findings fixed (all present in v1.0.0, independently verified against the tree)

1. Heap OOB read + write in st_read_f32 (st.h) — the serious one. numel comes from the tensor's shape, nbytes from its offsets; no cross-check. A crafted tensor with an inflated shape made the BF16/F16 loop read past the malloc'd raw buffer and the F32 memcpy write past the caller's config-sized destination. Now numel*esz == nbytes is enforced before any copy.
2. Integer overflow in the shape product (st.h) — numel *= shape[k] could wrap int64 to a small/negative value that then passes the cross-check. Each multiply is now guarded.
3. Silent int2 fallback → matmul OOB (glm.c) — the ?1:?2:3 fmt inference (duplicated at three sites) fell to int2 for any unrecognized weight byte count, so a too-short weight became a valid int2 whose matmul read O*I nibbles past the buffer, and an oversized scale array overflowed the per-row t->s. Replaced by one qt_resolve_fmt() that validates weight and scale byte counts against [O,I] or refuses.
4. Unbounded config slurp (glm.c) — ftell → malloc(n+1) gave a hostile config.json a load-time OOM, and b[got]=0 was a NULL-deref on malloc failure. Capped at 256 MB + NULL-checked.

Why not just wait for #368

#368 is the right full pass (server + build too) but needs a rebase and a split decision. This lands the memory-corruption items now, as a v1.0.1 candidate, with the smallest possible surface. The server-side items (fail-closed bind, Host allowlist, telemetry auth) still come via #368's rebase — no overlap.

Verification

• No regression: TF token-exactness byte-identical to the pre-change binary on every quant format — full-precision 32/32, int4 11/32, int2 1/32, mix 5/32 (the lossy numbers are intrinsic to the tiny random model, not this change).
• fmt=4 grouped preserved: the scale check is by construction the same condition detect_group_size already imposes.
• Hostile input refused cleanly: a hand-crafted safetensors with an inflated shape exits with a clear message instead of corrupting the heap.
• ASan + UBSan clean on both legit and hostile loads (only the pre-existing, documented one-time startup leaks remain).

Refs #368

🤖 Generated with Claude Code