aligntype

confirmedupstream bugC++Inference & servingJuly 13, 2026

the question

Does the GGUF reader abort the process when a file declares general.alignment with the wrong value type?

what came out

The reader sets ctx->alignment from gguf_get_val_u32 at gguf.cpp:610 with no type or arity guard, so a well-formed GGUF declaring general.alignment as INT32, UINT64, STRING, or an array trips an unconditional GGML_ASSERT and aborts. Every other malformed-metadata case returns nullptr cleanly. The accepting and aborting buffers differ by exactly one byte. Model-load DoS.

method & receipts

Result: confirmed
Pre-registered — the prediction was written down and committed before the run.
Reproducible — one script re-runs the whole thing from scratch.
Tested — a correctness/benchmark suite ships alongside the code.

→ read the code and re-run it

github.com/v-code01/aligntype