Verify gguf tensor size before allocating

candle-core/src/quantized/gguf_file.rs

@@ -1,6 +1,6 @@
 //! Support for the [GGUF file format](https://github.com/philpax/ggml/blob/gguf-spec/docs/gguf.md).
 //!
-//! Spec: https://github.com/ggml-org/ggml/blob/master/docs/gguf.md  
+//! Spec: https://github.com/ggml-org/ggml/blob/master/docs/gguf.md
 
 use super::{GgmlDType, QTensor};
 use crate::{Context, Device, Result};
@@ -99,8 +99,16 @@ impl TensorInfo {
         )
         }
         let size_in_bytes = tensor_elems / block_size * self.ggml_dtype.type_size();
+        let tensor_start = tensor_data_offset.saturating_add(self.offset);
+        let file_size = reader.seek(std::io::SeekFrom::End(0))?;
+        let remaining = file_size.saturating_sub(tensor_start);
+        if size_in_bytes as u64 > remaining {
+            crate::bail!(
+                "tensor needs {size_in_bytes} bytes at offset {tensor_start}, only {remaining} remaining in file"
+            )
+        }
         let mut raw_data = vec![0u8; size_in_bytes];
-        reader.seek(std::io::SeekFrom::Start(tensor_data_offset + self.offset))?;
+        reader.seek(std::io::SeekFrom::Start(tensor_start))?;
         reader.read_exact(&mut raw_data)?;
         super::ggml_file::qtensor_from_ggml(
             self.ggml_dtype,

candle-core/tests/gguf_tests.rs

@@ -1,6 +1,7 @@
 //! Regression tests for the allocation caps added in huggingface/candle#3533.
 
 use candle_core::quantized::gguf_file::Content;
+use candle_core::Device;
 use std::io::Cursor;
 
 const GGUF_MAGIC: [u8; 4] = *b"GGUF";
@@ -108,6 +109,24 @@ fn empty_v1_header_loads() {
     Content::read(&mut cursor).expect("empty v1 header should parse");
 }
 
+#[test]
+fn rejects_tensor_size_exceeding_file() {
+    // Create a gguf tensor that claims shape [1_073_741_824] F32 (4 GiB), but has no actual tensor data.
+    let mut buf = header(1, 0);
+    buf.extend(length_prefixed(b"t"));
+    buf.extend_from_slice(&1u32.to_le_bytes()); // n dims
+    buf.extend_from_slice(&1_073_741_824u64.to_le_bytes()); // 1 GiB elements
+    buf.extend_from_slice(&0u32.to_le_bytes()); // F32
+    buf.extend_from_slice(&0u64.to_le_bytes()); // no offset
+    let mut cursor = Cursor::new(buf);
+    let content = Content::read(&mut cursor).expect("header should parse");
+    let err = content
+        .tensor(&mut cursor, "t", &Device::Cpu)
+        .expect_err("expected Err from oversized tensor load");
+    let msg = format!("{err}");
+    assert!(msg.contains("remaining"), "unexpected error: {msg}");
+}
+
 #[test]
 fn rejects_string_length_above_remaining_file_bytes() {
     let mut buf = header(1, 0);