Skip to content

imatrix: reject a repeated entry with an inconsistent value count (#1749)#1750

Merged
leejet merged 1 commit into
leejet:masterfrom
professor-moody:fix-imatrix-oob-write
Jul 6, 2026
Merged

imatrix: reject a repeated entry with an inconsistent value count (#1749)#1750
leejet merged 1 commit into
leejet:masterfrom
professor-moody:fix-imatrix-oob-write

Conversation

@professor-moody

Copy link
Copy Markdown
Contributor

Fixes #1749.

load_imatrix resizes an entry's values/counts vectors only when they are empty, so a repeated tensor name with a larger nval writes past the end of both buffers in the accumulation loop. This mirrors the check collect_imatrix already does in the same file: reject a repeated entry whose value count does not match, instead of writing out of bounds. Valid imatrix files are unaffected; a crafted file with a mismatched repeated entry is cleanly rejected with an error.

@leejet leejet merged commit 4fcc6fe into leejet:master Jul 6, 2026
11 checks passed
@leejet

leejet commented Jul 6, 2026

Copy link
Copy Markdown
Owner

Thank you for your contribution.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Heap out-of-bounds write in load_imatrix via a duplicate tensor name

2 participants