gguf-py: bound array element count by remaining file size

[wmshearer]

The array branch of _get_field_parts validates the declared element count against GGUF_MAX_ARRAY_ELEMENTS but never against the bytes actually remaining in the file. A count below that ceiling still drives a full per-element loop, so a small file that declares a large array costs time proportional to the declared count rather than to the file size.

_get_str already performs the equivalent check for strings:

if offset + 8 + int(slen[0]) > self.data.nbytes:
    raise ValueError(f'String length ... exceeds remaining file size ...')

This adds the matching bound for arrays. Every element occupies at least one byte, so a declared count greater than the remaining byte count is not satisfiable and can be rejected before the loop starts.

Found by fuzzing gguf-py with Atheris. A 101-byte input declaring 13,434,883 elements took 43.9s of CPU to parse on master (2d8d612); with this change it raises immediately. A normal file with a 5,000 element array parses unchanged.

Testing:

• 101-byte fuzzer input: 43.9s before, immediate ValueError after
• Valid 74KB file with a 5,000 element array and one tensor: parses correctly with the change applied

Overview

Additional information

Requirements

• I have read and agree with the contributing guidelines
• AI usage disclosure:
  Yes: AI usage disclosure: AI-assisted. The bug was found by my own fuzzing campaign against gguf-py. I used AI assistance to identify the fix and draft this description, and reviewed and tested the change before submitting.

[CISC]

The check is incorrect.