Commit d3954b932 for llama.cpp
commit d3954b9324ad7501b81168ee49d178cd535723d9
Author: Adrien Gallouët <angt@huggingface.co>
Date: Tue Sep 29 22:44:41 2026 +0200
ggml : check row bounds in get_rows_back (#29575)
Signed-off-by: Adrien Gallouët <angt@huggingface.co>
diff --git a/ggml/src/ggml-cpu/ops.cpp b/ggml/src/ggml-cpu/ops.cpp
index a07e1f963..a6ccfe954 100644
--- a/ggml/src/ggml-cpu/ops.cpp
+++ b/ggml/src/ggml-cpu/ops.cpp
@@ -5351,6 +5351,8 @@ static void ggml_compute_forward_get_rows_back_f32_f16(
for (int i = 0; i < nr; ++i) {
const int r = ((int32_t *) src1->data)[i];
+ GGML_ASSERT(r >= 0 && r < dst->ne[1]);
+
for (int j = 0; j < nc; ++j) {
ggml_fp16_t v = ((ggml_fp16_t *) ((char *) src0->data + i*src0->nb[1]))[j];
((float *) ((char *) dst->data + r*dst->nb[1]))[j] += GGML_CPU_FP16_TO_FP32(v);
@@ -5384,6 +5386,8 @@ static void ggml_compute_forward_get_rows_back_f32(
for (int i = 0; i < nr; ++i) {
const int r = ((int32_t *) src1->data)[i];
+ GGML_ASSERT(r >= 0 && r < dst->ne[1]);
+
ggml_vec_add_f32(nc,
(float *) ((char *) dst->data + r*dst->nb[1]),
(float *) ((char *) dst->data + r*dst->nb[1]),