From 14423995ba4e918212eae1e8bda2300179324400 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Adrien=20Gallou=C3=ABt?= Date: Tue, 29 Sep 2026 22:44:41 +0200 Subject: [PATCH] ggml : check row bounds in get_rows_back (llama/29575) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Adrien Gallouët --- ggml/src/ggml-cpu/ops.cpp | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/ggml/src/ggml-cpu/ops.cpp b/ggml/src/ggml-cpu/ops.cpp index a07e1f963..a6ccfe954 100644 --- a/ggml/src/ggml-cpu/ops.cpp +++ b/ggml/src/ggml-cpu/ops.cpp @@ -5351,6 +5351,8 @@ static void ggml_compute_forward_get_rows_back_f32_f16( for (int i = 0; i < nr; ++i) { const int r = ((int32_t *) src1->data)[i]; + GGML_ASSERT(r >= 0 && r < dst->ne[1]); + for (int j = 0; j < nc; ++j) { ggml_fp16_t v = ((ggml_fp16_t *) ((char *) src0->data + i*src0->nb[1]))[j]; ((float *) ((char *) dst->data + r*dst->nb[1]))[j] += GGML_CPU_FP16_TO_FP32(v); @@ -5384,6 +5386,8 @@ static void ggml_compute_forward_get_rows_back_f32( for (int i = 0; i < nr; ++i) { const int r = ((int32_t *) src1->data)[i]; + GGML_ASSERT(r >= 0 && r < dst->ne[1]); + ggml_vec_add_f32(nc, (float *) ((char *) dst->data + r*dst->nb[1]), (float *) ((char *) dst->data + r*dst->nb[1]),