Skip to content

fix: null pointer dereference when loading malformed LoHa file - #1826

Merged
leejet merged 1 commit into
leejet:masterfrom
nmouha:fix-loha-crash
Jul 29, 2026
Merged

fix: null pointer dereference when loading malformed LoHa file#1826
leejet merged 1 commit into
leejet:masterfrom
nmouha:fix-loha-crash

Conversation

@nmouha

@nmouha nmouha commented Jul 28, 2026

Copy link
Copy Markdown
Contributor

Summary

In get_loha_weight_diff(), a null pointer dereference occurs when hada_t1 is present but hada_w1_a is missing, or when hada_t2 is present but hada_w2_a is missing.

Related Issue / Discussion

The nullptr check at line 368 (if (hada_1_up == nullptr || ...) is never reached because the crash happens first.

Additional Information

To reproduce the crash:

printf '\x8a\x00\x00\x00\x00\x00\x00\x00{"model.diffusion_model.input_blocks.1.1.transformer_blocks.0.attn1.to_q.hada_t1": {"dtype": "F32", "shape": [1], "data_offsets": [0, 4]}}AAAA' > /tmp/bad.safetensors
./bin/sd-cli -m ../models/v1-5-pruned-emaonly.safetensors --lora-model-dir /tmp -p "<lora:bad.safetensors:1.0>" -o /tmp/output.png

Checklist

@leejet
leejet merged commit 53856e7 into leejet:master Jul 29, 2026
9 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants