diff --git a/ggml/src/gguf.cpp b/ggml/src/gguf.cpp
index 89978e0ed4..ddeda5a3c8 100644
--- a/ggml/src/gguf.cpp
+++ b/ggml/src/gguf.cpp
@@ -234,15 +234,22 @@ struct gguf_reader {
         if (n > GGUF_MAX_ARRAY_ELEMENTS) {
             return false;
         }
+        const uint64_t nbytes = nbytes_remain();
         if constexpr (std::is_same<T, std::string>::value) {
             // strings are prefixed with their length, so we need to account for that
             if (n > SIZE_MAX / sizeof(uint64_t)) {
                 return false;
             }
+            if (nbytes < n * sizeof(uint64_t)) {
+                return false;
+            }
         } else {
             if (n > SIZE_MAX / sizeof(T)) {
                 return false;
             }
+            if (nbytes < n * sizeof(T)) {
+                return false;
+            }
         }
         dst.resize(n);
         for (size_t i = 0; i < dst.size(); ++i) {