Submit #1013917: ggml-org llama.cpp 2ed93db47 and earlier (fixed in PR #29992) CWE-617 (Reachable Assertion)

llama.cpp's Mirostat samplers do not validate that logits and probabilities
are finite before use. Two sinks in src/llama-sampler.cpp are reachable from
llama-server by a remote unauthenticated client selecting mirostat=1 or
mirostat=2:

1. Mirostat v1 (src/llama-sampler.cpp:2481): int(k) is computed where k can
be NaN, which is undefined behavior.

2. Mirostat v2 (src/llama-sampler.cpp:244): NaN or zero-sum probabilities
are passed to std::discrete_distribution, which aborts with "__sum > 0"
(SIGABRT) and kills the whole server process.

No attacker-controlled logits are required; the model's own logits trigger
the fault. Fixed in PR #29992.

• User: Jasmine-tim (UID 101909)
• Submission: 10/05/2026 14:24 (24 days ago)
• Moderation: 10/26/2026 11:17 (21 days later)
• Status: Accepted
• VulDB entry: 426361 [ggml-org llama.cpp up to 0.7.0 Mirostat Sampler src/llama-sampler.cpp assertion]
• Points: 17