AISpot

llama.cpp 修復控制向量層索引與 M-RoPE 位置越界寫入

llama.cpp releases版本更新地端推論開源

llama.cpp 建置 b11972 修復了兩個可能導致越界寫入的缺陷。common 部分讀取控制向量時,方向張量的層索引此前沒有上界,超大索引會讓以 int 計算的緩衝區大小和寫偏移溢位,從而寫到緩衝區之前;現在改為傳入模型層數、拒絕超限索引,並用 size_t 計算。

原標題:b11972
閱讀原文

評分45 / 44(平均 44,門檻 60)
狀態未入選

原文

common, mtmd: bound control vector layer indices and M-RoPE position loops ( #31336 ) common: bound control vector layer indices by the model layer count A direction tensor layer index is parsed from the tensor name with no upper bound, and the buffer size and write offset are computed in int. A large index overflows both, so the accumulation writes before the start of the buffer. Pass the model layer count to the loader, reject indices above it like the existing zero index check, and compute the sizes in size_t. mtmd: fill M-RoPE positions by whole merge tiles The position loops of the Qwen-VL, GLM, PaddleOCR and Qwen2.5-VL encoders hardcode a 2x2 merge inside a stride of n_merge, so a patch grid that is not a multiple of the merge writes past the positions buffer. Iterate over whole merge tiles with n_merge inner steps, which bounds the writes by the patch count and gives the same positions on aligned grids. PaddleOCR also requires a merge aligned image at graph build, as the Qwen-VL family already does. Website: https://llama.app Attestations: https://github.com/ggml-org/llama.cpp/attestations/61041957 macOS/iOS: macOS Apple Silicon (arm64) macOS Apple Silicon (arm64, KleidiAI enabled) DISABLED macOS Intel (x64) iOS XCFramework Linux: Ubuntu x64 (CPU) Ubuntu arm64 (CPU) Ubuntu s390x (CPU) Ubuntu 26.04 s390x (CPU) Ubuntu 26.04 s390x (zDNN) Ubuntu x64 (Vulkan) Ubuntu arm64 (Vulkan) Ubuntu x64 (CUDA 12) - CUDA 12.8 libraries Ubuntu x64 (CUDA 13) - CUDA 13.4 libraries Ubuntu arm64 (CUDA 13) - CUDA 13.4 libraries Ubuntu x64 (ROCm 10.0) Ubuntu x64 (OpenVINO) Ubuntu x64 (SYCL FP32) Ubuntu x64 (SYCL FP16) Linux arm64 (Snapdragon: CPU, Adreno GPU, Hexagon NPU) - setup guide Android: Android arm64 (CPU) Android arm64 (Snapdragon: CPU, Adreno GPU, Hexagon NPU) - setup guide Windows: Windows x64 (CPU) Windows arm64 (CPU) Windows arm64 (OpenCL Adreno) Windows x64 (CUDA 12) - CUDA 12.4 DLLs Windows x64 (CUDA 13) - CUDA 13.4 DLLs Windows arm64 (CUDA 13) - CUDA 13.4 DLLs Windows x64 (Vulkan) Windows arm64 (Vulkan) Windows x64 (OpenVINO) Windows x64 (SYCL) Windows x64 (ROCm 10.0) openEuler: DISABLED openEuler x86 (310p) openEuler x86 (910b, ACL Graph) openEuler aarch64 (310p) openEuler aarch64 (910b, ACL Graph) UI: UI

相關報導

llama.cpp releasesAI 評分46

llama.cpp 修復 ggml_acc 負偏移導致的越界寫

llama.cpp 建置 b11529 修復了 ggml 中 ggml_acc 的越界寫漏洞:ggml_acc_impl 將 size_t 偏移量收窄為 int32_t 時未做檢查,超大偏移會截斷成負數,再被符號擴充套件為巨大 size_t 導致邊界斷言失效,可在 dst 緩衝區下方越界寫入。修復方式是在收窄前檢查偏移量,與 ggml_set_impl 中已有檢查保持一致。該版本同時提供 macOS、Linux、Windows、Android 等多平台預編譯包。

llama.cpp releasesAI 評分41

llama.cpp 修復 Metal 大矩陣偏移溢位問題

llama.cpp 建置版本 b11895 修復了 Metal 後端在大型矩陣輸出偏移時出現的整數溢位,同時加寬了 batch 偏移與 MUL_MAT_ID 的 token 索引。改動由 Codex 輔助完成,屬於影響大模型在 Apple Silicon 上推理正確性的底層修復,本次建置仍按慣例提供 macOS、Linux、Windows、Android 等多平台二進位制包。

llama.cpp releasesAI 評分36

llama.cpp 修復 Vulkan 後端 RDNA4 矩陣向量調優

llama.cpp 發布 b11389 版本,修復了 Vulkan 後端在 RDNA4 架構上的矩陣向量運算調優問題(PR #29934)。該版本繼續提供覆蓋 macOS、Linux、Windows、Android 等平台的預編譯二進位制,包括 Vulkan、CUDA、ROCm、SYCL 等後端,其中 macOS Apple Silicon 的 KleidiAI 啟用版和 openEuler 建置被停用。

llama.cpp releasesAI 評分42

llama.cpp 發布 b11424,修復 Vulkan Flash Attention 共享記憶體越界寫

llama.cpp 發布 b11424 建置版本,修復 Vulkan 後端 Flash Attention 的共享記憶體越界寫問題(#29988)。該版本照例提供 macOS/iOS、Linux、Windows、Android 的預編譯包,涵蓋 Vulkan、CUDA 12/13、ROCm 10.0、OpenVINO、SYCL、OpenCL 等後端,並附驍龍 CPU/Adreno GPU/Hexagon NPU 的安裝指引。