From 8bcd53b74ec12b760adac186a98933c09ed29ad0 Mon Sep 17 00:00:00 2001 From: hourhl Date: Mon, 12 Jan 2026 15:53:05 +0800 Subject: [PATCH] Replace unsafe strnlen() with a bounds-checked loop that scans for \0 within the remaining array size. --- src/llama-vocab.cpp | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/src/llama-vocab.cpp b/src/llama-vocab.cpp index c9be238326..ebd1700402 100644 --- a/src/llama-vocab.cpp +++ b/src/llama-vocab.cpp @@ -1106,10 +1106,12 @@ private: throw std::runtime_error("Index out of array bounds in precompiled charsmap!"); } const char * prefix_replacement = &(tokenizer.prefix_replacements)[longest_prefix_offset]; - // Use strnlen to safely bound the search within prefix_replacements size_t max_len = tokenizer.prefix_replacements_size - longest_prefix_offset; - size_t repl_len = strnlen(prefix_replacement, max_len); - if (repl_len == max_len && prefix_replacement[max_len - 1] != '\0') { + size_t repl_len = 0; + while (repl_len < max_len && prefix_replacement[repl_len] != '\0') { + repl_len++; + } + if (repl_len == max_len) { throw std::runtime_error("Unterminated string in precompiled charsmap!"); } return { prefix_replacement, repl_len, longest_prefix_length };