Public/llama.cpp
1
0
Fork 0
mirror of https://github.com/ggml-org/llama.cpp.git synced 2026-09-19 17:24:57 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix use-after-free in llama-model-loader.cpp

Browse Source
This commit is contained in:
Johannes Gäßler
2026-03-04 12:36:09 +01:00
parent e6a6af1cef
commit 4b7f407ae8
2 changed files with 7 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/llama-model-loader.cpp
+5 -4
View File
@@ -1156,12 +1156,13 @@ struct ggml_tensor * llama_model_loader::create_tensor(
}
if (buft != buft_list->front().second) {
n_tensors_moved++;
if (!first_tensor_moved) {
first_tensor_moved = t_meta;
if (n_tensors_moved == 0) {
first_tensor_moved_name = t_meta->name;
first_tensor_moved_type_name = ggml_type_name(t_meta->type);
first_moved_from_buft = buft_list->front().second;
first_moved_to_buft = buft;
}
n_tensors_moved++;
}
return buft;
@@ -1275,7 +1276,7 @@ void llama_model_loader::done_getting_tensors() const {
}
if (n_tensors_moved > 0) {
LLAMA_LOG_DEBUG("%s: tensor '%s' (%s) (and %zu others) cannot be used with preferred buffer type %s, using %s instead\n",
__func__, first_tensor_moved->name, ggml_type_name(first_tensor_moved->type), n_tensors_moved - 1,
__func__, first_tensor_moved_name.c_str(), first_tensor_moved_type_name.c_str(), n_tensors_moved - 1,
ggml_backend_buft_name(first_moved_from_buft), ggml_backend_buft_name(first_moved_to_buft));
}
}
src/llama-model-loader.h
+2 -1
View File
@@ -114,7 +114,8 @@ struct llama_model_loader {
// track tensors that had to be moved for debugging:
size_t n_tensors_moved = 0;
ggml_tensor * first_tensor_moved = nullptr;
std::string first_tensor_moved_name;
std::string first_tensor_moved_type_name;
ggml_backend_buffer_type_t first_moved_from_buft = nullptr;
ggml_backend_buffer_type_t first_moved_to_buft = nullptr;