Commit d3954b932 for llama.cpp

commit d3954b9324ad7501b81168ee49d178cd535723d9
Author: Adrien Gallouët <angt@huggingface.co>
Date:   Tue Sep 29 22:44:41 2026 +0200

    ggml : check row bounds in get_rows_back (#29575)

    Signed-off-by: Adrien Gallouët <angt@huggingface.co>

diff --git a/ggml/src/ggml-cpu/ops.cpp b/ggml/src/ggml-cpu/ops.cpp
index a07e1f963..a6ccfe954 100644
--- a/ggml/src/ggml-cpu/ops.cpp
+++ b/ggml/src/ggml-cpu/ops.cpp
@@ -5351,6 +5351,8 @@ static void ggml_compute_forward_get_rows_back_f32_f16(
     for (int i = 0; i < nr; ++i) {
         const int r = ((int32_t *) src1->data)[i];

+        GGML_ASSERT(r >= 0 && r < dst->ne[1]);
+
         for (int j = 0; j < nc; ++j) {
             ggml_fp16_t v = ((ggml_fp16_t *) ((char *) src0->data + i*src0->nb[1]))[j];
             ((float *) ((char *) dst->data + r*dst->nb[1]))[j] += GGML_CPU_FP16_TO_FP32(v);
@@ -5384,6 +5386,8 @@ static void ggml_compute_forward_get_rows_back_f32(
     for (int i = 0; i < nr; ++i) {
         const int r = ((int32_t *) src1->data)[i];

+        GGML_ASSERT(r >= 0 && r < dst->ne[1]);
+
         ggml_vec_add_f32(nc,
                 (float *) ((char *)  dst->data + r*dst->nb[1]),
                 (float *) ((char *)  dst->data + r*dst->nb[1]),