From: Dev-X25874 <redacted>
Date: Thu, 21 May 2026 11:58:08 +0000 (+0530)
Subject: ggml-alloc: fix out-of-bounds read in ggml_dyn_tallocr_remove_block (ggml/1492)
X-Git-Tag: upstream/0.0.10438~1117
X-Git-Url: https://git.djapps.eu/?a=commitdiff_plain;h=fa9704152416df37cd28b308a640378e1414ea8d;p=pkg%2Fggml%2Fsources%2Fllama.cpp

ggml-alloc: fix out-of-bounds read in ggml_dyn_tallocr_remove_block (ggml/1492)
---

diff --git a/ggml/src/ggml-alloc.c b/ggml/src/ggml-alloc.c
index a4b01ccf8..3bda9abbe 100644
--- a/ggml/src/ggml-alloc.c
+++ b/ggml/src/ggml-alloc.c
@@ -150,7 +150,7 @@ static void ggml_dyn_tallocr_insert_block(struct tallocr_chunk * chunk, size_t o
 
 static void ggml_dyn_tallocr_remove_block(struct tallocr_chunk * chunk, int idx) {
     // shift all elements after idx by 1 to the left, overwriting the element at idx
-    for (int i = idx; i < chunk->n_free_blocks; i++) {
+    for (int i = idx; i < chunk->n_free_blocks - 1; i++) {
         chunk->free_blocks[i] = chunk->free_blocks[i+1];
     }
     chunk->n_free_blocks--;