Skip to content

fix: correct bounds check in XCDA array access#17215

Merged
CISC merged 1 commit intoggml-org:masterfrom
o7si:index_out_of_array_bounds
Nov 12, 2025
Merged

fix: correct bounds check in XCDA array access#17215
CISC merged 1 commit intoggml-org:masterfrom
o7si:index_out_of_array_bounds

Conversation

@o7si
Copy link
Copy Markdown
Contributor

@o7si o7si commented Nov 12, 2025

In the constructor of llm_tokenizer_ugm, xcda_array is an array with xcda_array_size elements:

xcda_array = (const uint32_t *) &precompiled_charsmap[charsmap_offset];
xcda_array_size = xcda_blob_size / sizeof(uint32_t);

The valid index range is [0, xcda_array_size).

When xcda_array_view is constructed using these parameters:

struct xcda_array_view xcda_view(tokenizer.xcda_array, tokenizer.xcda_array_size);

The accessible index range remains [0, xcda_array_size).

Therefore, in the xcda_array_view::get_node function, it should use >= to check for bounds violation instead of >.

@CISC
Copy link
Copy Markdown
Member

CISC commented Nov 12, 2025

Nice catch, thank you, merging when CIs are done.

@CISC CISC merged commit ffb6f3d into ggml-org:master Nov 12, 2025
72 checks passed
Anico2 added a commit to Anico2/llama.cpp that referenced this pull request Jan 15, 2026
Seunghhon pushed a commit to Seunghhon/llama.cpp that referenced this pull request Apr 26, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants