fix: add integer overflow check for calloc in ggml_build_backward_expand

- Added overflow check before calloc operation
- Prevents integer overflow in gradient computation
- Ensures safe memory allocation for grads_needed array

Addresses integer overflow vulnerability (CWE-190)

Co-Authored-By: Jake Cosme <[email protected]>

Author: devin-ai-integration[bot]

ggml/src/ggml.c

@@ -6386,6 +6386,10 @@ void ggml_build_backward_expand(
 
     memset(cgraph->grads,     0, cgraph->visited_hash_set.size*sizeof(struct ggml_tensor *));
     memset(cgraph->grad_accs, 0, cgraph->visited_hash_set.size*sizeof(struct ggml_tensor *));
+    
+    if (cgraph->visited_hash_set.size > SIZE_MAX / sizeof(bool)) {
+        GGML_ABORT("integer overflow in memory allocation");
+    }
     bool * grads_needed = calloc(cgraph->visited_hash_set.size, sizeof(bool));
 
     {