From 17d8309fe0ef997087a060a03457e1f7353e7505 Mon Sep 17 00:00:00 2001
From: Andrea Arcangeli <aarcange@redhat.com>
Date: Fri, 2 Jan 2026 17:42:31 +0100
Subject: [PATCH] grammar: add test case for nullable symbol loop

Reproduce stack overflow (or OOM) with ( [x]* )* found while adding
GBNF support to ripgrep-edit.

llama-server reproducer:

curl \
  -X POST \
  -d '{
    "messages": [{ "role": "user", "content": "write yes" }],
    "grammar": "root ::= ( [x]* )*"
  }' \
  -H "Content-Type: application/json" \
  http://localhost:8811/v1/chat/completions

Not security related according to
https://github.com/ggml-org/llama.cpp/security#untrusted-environments-or-networks
---
 tests/test-grammar-integration.cpp | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/tests/test-grammar-integration.cpp b/tests/test-grammar-integration.cpp
index 7aa7e58a5c..84a680c670 100644
--- a/tests/test-grammar-integration.cpp
+++ b/tests/test-grammar-integration.cpp
@@ -784,6 +784,24 @@ static void test_quantifiers() {
             "0xFF 0x12 0xAB 0x00 0x00 0x00",
         }
     );
+    test_grammar(
+        "segfault",
+        // Grammar
+        R"""(
+            root ::= ( [x]* )*
+        )""",
+        // Passing strings
+        {
+		"",
+		"x",
+		"xx"
+        },
+        // Failing strings
+        {
+		"y",
+		"yy"
+        }
+    );
 }
 
 static void test_failure_missing_root() {