Harden GGUF parsing: bound file-controlled lengths/offsets/dimensions

[professor-moody]

Summary

Crafted .gguf files can crash gguflib's parse path: out-of-bounds reads (SIGSEGV), an out-of-bounds write (a tensor declaring n_dims > 8), and a divide-by-zero (general.alignment = 0). The shared root cause is that file-controlled length/offset/dimension fields are used to index and advance into the mmap'd buffer with no validation against ctx->size. This PR adds uniform bounds checks so malformed files are rejected instead of crashing.

Addresses #25 and #27.

Changes (gguflib.c)

• gguf_get_alignment_padding() — return 0 when alignment == 0 (a malformed general.alignment=0 caused offset % 0 → SIGFPE). [Divide-by-zero (SIGFPE) in gguflib from untrusted general.alignment value #27]
• gguf_get_key() — bound the length prefix, key name, and type tag against ctx->size before dereferencing. [Out-of-bounds write in gguf_get_tensor when n_dims > 8 (CWE-787), plus OOB reads in metadata parsing #25]
• gguf_set_data_offset() — bound every field in the tensor-info walk against ctx->size; stop instead of walking the offset past the mmap. [Out-of-bounds write in gguf_get_tensor when n_dims > 8 (CWE-787), plus OOB reads in metadata parsing #25]
• gguf_get_tensor() — reject ndim > GGUF_TENSOR_MAX_DIM with a parse error instead of assert(). The assert is compiled out under -DNDEBUG, leaving an out-of-bounds write to the fixed-size tensor->dim[]. Also bound the per-dimension reads against the file. [Out-of-bounds write in gguf_get_tensor when n_dims > 8 (CWE-787), plus OOB reads in metadata parsing #25]
• Overflow-checked num_weights accumulation (a crafted dimension could otherwise wrap it).

Testing

• Built with clang -O3. The minimal PoCs from Out-of-bounds write in gguf_get_tensor when n_dims > 8 (CWE-787), plus OOB reads in metadata parsing #25/Divide-by-zero (SIGFPE) in gguflib from untrusted general.alignment value #27 (alignment div-by-zero, gguf_get_key OOB read, tensor-info-walk OOB read, metadata / data-offset OOB reads) now reject the file cleanly instead of SIGSEGV/SIGFPE.
• Non-regression: gguf-tools show produces byte-identical output to the unpatched build on valid .gguf files.

No RCE is claimed — these are memory-safety crashes (DoS / OOB) on attacker-supplied files.