Skip to content

fix: null pointer dereference when loading malformed LoHa file - #1826

Open
nmouha wants to merge 1 commit into
leejet:masterfrom
nmouha:fix-loha-crash
Open

fix: null pointer dereference when loading malformed LoHa file#1826
nmouha wants to merge 1 commit into
leejet:masterfrom
nmouha:fix-loha-crash

Conversation

@nmouha

@nmouha nmouha commented Jul 28, 2026

Copy link
Copy Markdown

Summary

In get_loha_weight_diff(), a null pointer dereference occurs when hada_t1 is present but hada_w1_a is missing, or when hada_t2 is present but hada_w2_a is missing.

Related Issue / Discussion

The nullptr check at line 368 (if (hada_1_up == nullptr || ...) is never reached because the crash happens first.

Additional Information

To reproduce the crash:

printf '\x8a\x00\x00\x00\x00\x00\x00\x00{"model.diffusion_model.input_blocks.1.1.transformer_blocks.0.attn1.to_q.hada_t1": {"dtype": "F32", "shape": [1], "data_offsets": [0, 4]}}AAAA' > /tmp/bad.safetensors
./bin/sd-cli -m ../models/v1-5-pruned-emaonly.safetensors --lora-model-dir /tmp -p "<lora:bad.safetensors:1.0>" -o /tmp/output.png

Checklist

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant