Skip to content

Fix out-of-bounds write in gguf_q4_0/q4_1_to_float second nibble loop #31

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
gigioneggiando wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Fix out-of-bounds write in gguf_q4_0/q4_1_to_float second nibble loop #31

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions gguflib.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -824,6 +824,12 @@ void gguf_q4_0_to_float(void *weights_data, void *dst, uint64_t count, store_flo
f[i] = weight;
if (++i == count) break;
}
/* Stop before the upper-nibble loop if we already emitted 'count'
* weights in the lower-nibble loop: that loop's own (++i == count)
* break only exits itself, and the check below can never fire again
* once i == count, so without this the upper loop would write up to
* 16 floats past the end of 'dst'. */
if (i == count) break;
/* Last 16 weights are in the higher bits */
for (uint32_t j = 0; j < 16; j++) {
uint8_t value = block[j+2]; // j+2 to skip the scale bytes.
Expand Down Expand Up @@ -866,6 +872,10 @@ void gguf_q4_1_to_float(void *weights_data, void *dst, uint64_t count, store_flo
f[i] = weight;
if (++i == count) break;
}
/* Stop before the upper-nibble loop if we already emitted 'count'
* weights: as in gguf_q4_0_to_float, the lower loop's break only exits
* itself, so without this the upper loop would write past 'dst'. */
if (i == count) break;
/* Last 16 weights are in the higher bits */
for (uint32_t j = 0; j < 16; j++) {
uint8_t value = block[j+4]; // j+2 to skip the scale and bias bytes.
Expand Down