Commit 0978a6e90 for llama.cpp

commit 0978a6e9022fb9bd6874b86154ee304e81929b9f
Author: Jasmine-tim <403568753@qq.com>
Date:   Tue Nov 3 19:26:29 2026 +0800

    ggml: avoid signed overflow in ggml_roll bounds check (#30375)

    ggml_roll validated each shift with abs(shift), but abs(INT_MIN) is signed
    integer overflow UB evaluated before the bounds check runs. Compare with a
    signed-safe test instead.

diff --git a/ggml/src/ggml.c b/ggml/src/ggml.c
index 3d60c44e5..b91d98845 100644
--- a/ggml/src/ggml.c
+++ b/ggml/src/ggml.c
@@ -5389,10 +5389,10 @@ struct ggml_tensor * ggml_roll(
         int                   shift2,
         int                   shift3) {
     GGML_ASSERT(a->nb[0] == ggml_type_size(a->type));
-    GGML_ASSERT(abs(shift0) < a->ne[0]);
-    GGML_ASSERT(abs(shift1) < a->ne[1]);
-    GGML_ASSERT(abs(shift2) < a->ne[2]);
-    GGML_ASSERT(abs(shift3) < a->ne[3]);
+    GGML_ASSERT(shift0 > -a->ne[0] && shift0 < a->ne[0]);
+    GGML_ASSERT(shift1 > -a->ne[1] && shift1 < a->ne[1]);
+    GGML_ASSERT(shift2 > -a->ne[2] && shift2 < a->ne[2]);
+    GGML_ASSERT(shift3 > -a->ne[3] && shift3 < a->ne[3]);

     struct ggml_tensor * result = ggml_dup_tensor(ctx, a);