Skip to content

Conversation

@ngxson
Copy link
Collaborator

@ngxson ngxson commented Nov 18, 2025

Fix #17355

Hmm on second thought, yes it can be better to use size_t, as even when overflow it won't be a negative.

But please note that overflow can still potentially happen.

Also, I didn't notice that * 1.25 will convert it to double, so we should use integer division instead.

@ngxson ngxson requested a review from ggerganov November 18, 2025 10:48
Co-authored-by: Georgi Gerganov <ggerganov@gmail.com>
@ngxson ngxson merged commit 10e9780 into ggml-org:master Nov 18, 2025
64 of 71 checks passed
ronaldmannak pushed a commit to PicoMLX/llama.cpp that referenced this pull request Nov 19, 2025
…l-org#17357)

* chat: fix int overflow, prevent size calculation in float/double

* Update common/chat.cpp

Co-authored-by: Georgi Gerganov <ggerganov@gmail.com>

---------

Co-authored-by: Georgi Gerganov <ggerganov@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Misc. bug: The function common_chat_templates_apply_legacy has an integer overflow vulnerability

2 participants