grammar : reject inverted repetition range {m,n} (m>n)

[harrison001]

Overview

handle_repetitions in llama_grammar_parser::parse_sequence computes the optional-repetition count as an unsigned subtraction:

auto n_opt = no_max ? 1 : max_times - min_times;   // both uint64_t
for (uint64_t i = 0; i < n_opt; i++) { ...; add_rule(...); }

For an inverted range like {2,1} (min=2, max=1), max_times - min_times underflows to ~1.8e19, so the loop appends rules until the process is OOM-killed. The existing MAX_REPETITION_THRESHOLD guard does not catch this, because it is computed from total_rules = max_times (which is 1 here), not from the underflowed n_opt.

Because grammar is accepted from untrusted request bodies by llama-server (/completion, and the json_schema→grammar path of /v1/chat/completions), this is a remote, unauthenticated DoS.

This PR rejects max_times < min_times before expansion; parse() already catches std::runtime_error and returns a clean parse failure.

Additional information

Minimal PoC (18 bytes):

root ::= "a"{2,1}

→ unbounded memory growth (libFuzzer OOM over llama_grammar_parser::parse). Found on master via libFuzzer + ASan.

Requirements

• I have read and agree with the contributing guidelines
• AI usage disclosure: YES — the bug was found via libFuzzer + AddressSanitizer fuzzing of llama_grammar_parser::parse; the one-line fix and the PoC were drafted with the help of an AI coding assistant and reviewed/verified by me. I am responsible for all submitted changes.

[ggml-gh-bot]

Hi @harrison001, thanks for your contribution!

Per our contribution guidelines, the automated PR checker found the following issue(s) that need your attention:

• PR Template not respected: Please respect the template when creating a new pull request. Make sure to fill out all required sections.

• Multiple open PRs from a new contributor: We limit new contributors (those without a previously merged PR) to 1 open PR at a time. You currently have 2 open PRs.

• AI-generated content: This project does not accept PRs, descriptions or commit messages that are fully or predominantly AI-generated. If you have used AI to assist you in writing code, please make sure to disclose that explicitly.

---

Please note that maintainers reserve the right to make final decisions on PRs. If you believe there is a mistake, please comment below.