Harden GGUF parsing: bound file-controlled lengths/offsets/dimensions

[professor-moody]

Summary

Crafted .gguf files can crash gguflib's parse path: out-of-bounds reads (SIGSEGV), an out-of-bounds write (a tensor declaring n_dims > 8), and a divide-by-zero (general.alignment = 0). The shared root cause is that file-controlled length/offset/dimension fields are used to index and advance into the mmap'd buffer with no validation against ctx->size. This PR adds uniform bounds checks so malformed files are rejected instead of crashing.

Addresses #25 and #27.

Changes (gguflib.c)

• gguf_get_alignment_padding() — return 0 when alignment == 0 (a malformed general.alignment=0 caused offset % 0 → SIGFPE). [Divide-by-zero (SIGFPE) in gguflib from untrusted general.alignment value #27]
• gguf_get_key() — bound the length prefix, key name, and type tag against ctx->size before dereferencing. [Out-of-bounds write in gguf_get_tensor when n_dims > 8 (CWE-787), plus OOB reads in metadata parsing #25]
• gguf_set_data_offset() — bound every field in the tensor-info walk against ctx->size; stop instead of walking the offset past the mmap. [Out-of-bounds write in gguf_get_tensor when n_dims > 8 (CWE-787), plus OOB reads in metadata parsing #25]
• gguf_get_tensor() — reject ndim > GGUF_TENSOR_MAX_DIM with a parse error instead of assert(). The assert is compiled out under -DNDEBUG, leaving an out-of-bounds write to the fixed-size tensor->dim[]. Also bound the per-dimension reads against the file. [Out-of-bounds write in gguf_get_tensor when n_dims > 8 (CWE-787), plus OOB reads in metadata parsing #25]
• Overflow-checked num_weights accumulation (a crafted dimension could otherwise wrap it).

Testing

• Built with clang -O3. The minimal PoCs from Out-of-bounds write in gguf_get_tensor when n_dims > 8 (CWE-787), plus OOB reads in metadata parsing #25/Divide-by-zero (SIGFPE) in gguflib from untrusted general.alignment value #27 (alignment div-by-zero, gguf_get_key OOB read, tensor-info-walk OOB read, metadata / data-offset OOB reads) now reject the file cleanly instead of SIGSEGV/SIGFPE.
• Non-regression: gguf-tools show produces byte-identical output to the unpatched build on valid .gguf files.

No RCE is claimed — these are memory-safety crashes (DoS / OOB) on attacker-supplied files.

[gigioneggiando]

Nice hardening. One gap worth noting so it isn't assumed fully closed: this bounds the metadata / tensor-info walk (key lengths, dimension counts, the offset scan in gguf_set_data_offset), but it does not bound the tensor data region itself.

In gguf_get_tensor(), after the dimensions are read:

tensor->offset = ctx->data_off + *offset;      // raw file-supplied 64-bit offset
tensor->weights_data = ctx->data + tensor->offset;

*offset and the resulting tensor->bsize are never checked against ctx->size, so a crafted tensor offset/size still places weights_data outside the mapping. Any later read of bsize bytes from it (gguf_tensor_to_float, inspect-tensor, compare) is then an out-of-bounds read, even with this PR applied.

Would be a natural addition here: once ctx->data_off is known, verify tensor->offset <= ctx->size and tensor->bsize <= ctx->size - tensor->offset (overflow-checked) before weights_data is formed or dereferenced. Happy to send a follow-up patch on top of this if useful.

[professor-moody]

Thanks @gigioneggiando, good catch. You're right that this PR only bounds the metadata/tensor-info walk and not the tensor data region: *offset and the resulting bsize in gguf_get_tensor() are never checked against ctx->size, so a crafted tensor offset/size still places weights_data outside the mapping. A follow-up that verifies tensor->offset <= ctx->size and tensor->bsize <= ctx->size - tensor->offset (overflow-checked) before weights_data is formed or dereferenced would be a welcome addition on top of this. Please do send it, happy to review and rebase.

[gigioneggiando]

Thanks @professor-moody! Sent it as #33 — it bounds tensor->offset/bsize against ctx->size (overflow-safe) before weights_data is formed, exactly as you described. It only touches the offset/bsize tail of gguf_get_tensor, not the ndim/dimension area this PR changes, so it should apply cleanly next to #28; happy to rebase on top if #28 lands first.