diff --git a/backport-CVE-2025-53630.patch b/backport-CVE-2025-53630.patch new file mode 100644 index 0000000000000000000000000000000000000000..b293355131b8549b4c2c9f7c381d8835cff391ad --- /dev/null +++ b/backport-CVE-2025-53630.patch @@ -0,0 +1,34 @@ +From 7d00e32369b13b1820d4acbf453232cef6de3171 Mon Sep 17 00:00:00 2001 +From: Miaoqian Lin +Date: Wed, 9 Jul 2025 20:33:53 +0800 +Subject: [PATCH] ggml : prevent integer overflow in gguf tensor size + calculation (#14595) + +--- + ggml/src/ggml.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/ggml/src/ggml.c b/ggml/src/ggml.c +index 058941c..8845215 100644 +--- a/ggml/src/ggml.c ++++ b/ggml/src/ggml.c +@@ -6854,7 +6854,14 @@ struct gguf_context * gguf_init_from_file(const char * fname, struct gguf_init_p + + const size_t size_cur = ggml_row_size(info->type, ne); + +- ctx->size += GGML_PAD(size_cur, ctx->alignment); ++ size_t padded_size = GGML_PAD(size_cur, ctx->alignment); ++ if (SIZE_MAX - ctx->size < padded_size) { ++ GGML_LOG_ERROR("%s: tensor size overflow, cannot accumulate size %zu + %zu\n", ++ __func__, ctx->size, padded_size); ++ gguf_free(ctx); ++ return NULL; ++ } ++ ctx->size += padded_size; + } + } + +-- +2.43.0 + + diff --git a/llama.cpp.spec b/llama.cpp.spec index c057fc2423e9e60e6659e782b775b31beb9bc8cc..c8ff0ee9d4110a31fb77c9b7bcb5954f6a570a6e 100644 --- a/llama.cpp.spec +++ b/llama.cpp.spec @@ -3,7 +3,7 @@ Name: llama.cpp Version: 20230815 -Release: 5 +Release: 6 License: MIT Summary: Port of English lagre model LLaMA implemented based on C/C++ @@ -11,6 +11,7 @@ URL: https://github.com/ggerganov/llama.cpp Source0: https://github.com/ggerganov/llama.cpp/archive/refs/tags/%{llama_commitid}.tar.gz Patch0: add-loongarch64-support.patch Patch1: backport-CVE-2025-52566.patch +Patch2: backport-CVE-2025-53630.patch BuildRequires: gcc,gcc-c++,cmake @@ -41,6 +42,9 @@ popd %{_libdir}/libembdinput.a %changelog +* Tue Jul 29 2025 yanglongkang - 20230815-6 +- fix CVE-2025-53630 + * Thu Jul 10 2025 PshySimon - 20230815-5 - fix CVE-2025-52566