Skip to content

Commit 2bcdddd

Browse files
authored
fix(rpc): prevent division by zero in deserialize_tensor (ggml-org#20712)
rpc : prevent division by zero in deserialize_tensor When receiving an RPC message with a deprecated tensor type (e.g., type 4 or 5 where `blck_size == 0`), `ggml_row_size()` will trigger a division by zero (SIGFPE) and crash the rpc-server. This patch adds a simple validation check in `deserialize_tensor` to return `nullptr` if the requested tensor type has a block size of 0. (Note: This was originally reported via Security Advisory and maintainer suggested dropping a patch here). * style: remove trailing whitespace
1 parent eac9c6e commit 2bcdddd

1 file changed

Lines changed: 7 additions & 1 deletion

File tree

ggml/src/ggml-rpc/ggml-rpc.cpp

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1162,12 +1162,18 @@ ggml_tensor * rpc_server::deserialize_tensor(struct ggml_context * ctx, const rp
11621162
return nullptr;
11631163
}
11641164

1165+
// Fix: Prevent division by zero if blck_size is 0 (e.g., deprecated types)
1166+
if (ggml_blck_size((enum ggml_type)tensor->type) == 0) {
1167+
GGML_LOG_ERROR("[%s] invalid tensor type received (blck_size is 0): %u\n", __func__, tensor->type);
1168+
return nullptr;
1169+
}
1170+
11651171
ggml_tensor * result = ggml_new_tensor_4d(ctx, (ggml_type) tensor->type,
11661172
tensor->ne[0], tensor->ne[1], tensor->ne[2], tensor->ne[3]);
11671173

11681174
// ggml_new_tensor_4d might fail if dimensions are invalid, although less likely to crash than invalid type
11691175
if (result == nullptr) {
1170-
GGML_LOG_ERROR("[%s] ggml_new_tensor_4d failed for type %u\\n", __func__, tensor->type);
1176+
GGML_LOG_ERROR("[%s] ggml_new_tensor_4d failed for type %u\n", __func__, tensor->type);
11711177
return nullptr;
11721178
}
11731179

0 commit comments

Comments
 (0)