llama.cpp b11529 修复 ggml_acc 越界写入漏洞

AI 摘要

llama.cpp 发布 b11529 版本，修复了 ggml_acc 中因负偏移量导致的越界写入漏洞。ggml_acc_impl 在将 size_t 偏移量收窄为 int32_t 时未做范围检查，大偏移量截断为负数后被符号扩展为巨大 size_t，绕过边界断言，造成 dst 缓冲区下方越界写入。修复方式是在收窄前检查偏移量，与 ggml_set_impl 中已有检查保持一致。该版本同时提供 macOS、Linux、Windows、Android 等多平台预编译包。

正文节选

<details open> ggml: fix OOB write in ggml_acc with negative offset (#30135) ggml_acc_impl narrowed a size_t offset to int32_t without checking that it fits, so a large offset could truncate to a negative int32_t. The forward then sign-extended it to a huge size_t and the bounds assertion wrapped, allowing an OOB write below the dst buffer. Check the offset before the narrowing, matching the existing check in ggml_set_impl. </details> **Website:** - <https://llama.app> **Attestations:** - <

发布时间：2026-10-09 23:14

抓取时间：2026-10-09 23:15

来源机构：ggml-org