wavtokenizer-dec : bound posnet/convnext block_count against n_layer_all - #26892
Merged
ggerganov merged 2 commits intoAug 12, 2026
Merged
Conversation
This comment was marked as resolved.
This comment was marked as resolved.
ggml-gh-bot
Bot
added
the
draft
github-actions
Bot
removed
the
draft
CISC
reviewed
Aug 11, 2026
CISC
left a comment
CISC
left a comment
Member
There was a problem hiding this comment.
Please update OP to use our PR template.
Co-authored-by: Sigbjørn Skjæret <sigbjorn.skjaeret@huggingface.co>
CISC
approved these changes
Aug 11, 2026
CISC
added
the
merge ready
CISC
marked this pull request as ready for review
August 11, 2026 09:00
Contributor
Author
|
Thanks ! The template should be fixed now. Is anything else needed ?
|
Member
All good, PR will be merged after 2nd approval. |
gabe-l-hart
added a commit
to gabe-l-hart/llama.cpp
that referenced
this pull request
Aug 12, 2026
Signed-off-by: Gabe Goodhart <ghart@us.ibm.com> * origin/master: (383 commits) cmake : introduce semantic versioning (ggml-org#26839) gguf : harden loader against malformed tensor dims and metadata types (ggml-org#25596) kleidiai: Add runtime feature detection mechanism for aarch64/kleidiai (ggml-org#26076) model : disallow integer dflash sliding_window_pattern (ggml-org#26900) sync : ggml cmake : add config version support (ggml/1582) server : support slot save/restore with media inputs (ggml-org#26640) ui: add read_media tool (ggml-org#25877) opencl: default FA c8 cluster width to 16 on X1E (ggml-org#26433) tests : update speculative params (ggml-org#26925) vulkan: add TQ2_0 (ternary) support (ggml-org#25850) wavtokenizer-dec : bound posnet/convnext block_count against n_layer_all (ggml-org#26892) convert : handle per_layer_config in Gemma4 (transformers 5.15) (ggml-org#26882) opencl: use flat mv q5_k when weight exceeds image1d_buffer_t limit (ggml-org#26880) chat : fix muse-glimmer detection of tool calls after EOM (ggml-org#26879) ci : add missing release check (ggml-org#26923) CUDA: only disable CUDA graphs when mul_mat_id actually needs a stream sync (ggml-org#26802) cuda : add warp-per-row wkv7 kernel for single-token decode (ggml-org#26111) spec : update speculative-simple (ggml-org#26904) chat : tighten bare function parsing for Qwen models (ggml-org#26793) ...
huaxel
pushed a commit
to huaxel/CachyLLama
that referenced
this pull request
Aug 12, 2026
…all (ggml-org#26892) * wavtokenizer-dec : bound posnet/convnext block_count against n_layer_all * Update src/llama-model.cpp Co-authored-by: Sigbjørn Skjæret <sigbjorn.skjaeret@huggingface.co> --------- Co-authored-by: Sigbjørn Skjæret <sigbjorn.skjaeret@huggingface.co>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Overview
Adds GGML_ASSERT bounds for posnet.block_count and convnext.block_count
against the base n_layer_all. These keys were read without any upper
bound check in the wavtokenizer-dec load_hparams path, unlike block_count
which was bounded in PR #26051.
A crafted GGUF with block_count=1 but posnet.block_count>=2 causes
dev_layer.at() out_of_range during model load.
PoC: https://huggingface.co/oguzhanakkaya/poc-wavtokenizer-posnet-oob-gguf
Additional information
2-line fix. Same bug class as the n_layer_all bound from #26051, missed
sibling keys in the same load_hparams block.
Requirements