Code execution via unchecked GGUF size addition

Heap buffer overflow in llama.cpp before b8146 allows local users to execute code by inducing processing of a crafted GGUF file. In gguf_init_from_file_impl, an unchecked addition of tensor overhead to ctx->size wraps mem_size, so ggml_init allocates a tiny heap buffer before fread copies attacker-controlled tensor data beyond it. The vulnerable no_alloc=false path is used by llama-quantize, llama-imatrix, control vectors, and llama-gguf; the main model loader is unaffected, and demonstrated outcomes range from a crash on macOS to code execution on Linux/glibc.