Heap memory corruption via tensor-size integer overflow

Heap buffer overflow in ggml-org llama.cpp before commit 26a48ad allows attackers to read or write heap memory via a crafted GGUF file. The gguf_init_from_file_impl function accumulates padded tensor sizes in ctx->size without checking for size_t wraparound, allocates the resulting undersized heap buffer, and derives tensor data pointers from attacker-controlled offsets. Loading the file with allocation enabled exposes invalid tensor pointers that can disclose or corrupt heap data or crash the process.