llama.cpp icon indicating copy to clipboard operation
llama.cpp copied to clipboard

[Bug] LLava 1.6 core dump happened in bicubic_resize.

Open gryffindor-rr opened this issue 1 year ago • 0 comments

https://github.com/ggerganov/llama.cpp/blame/1d1ccce67613674c75c9c7e3fa4c1e24e428ba48/examples/llava/clip.cpp#L1630

core dump happened in bicubic_resize. dbg core_file reports like

Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x000055e68efaa5be in bicubic_resize (img=..., dst=..., target_width=target_width@entry=364, target_height=target_height@entry=546) at /usr/include/c++/11/bits/stl_vector.h:1061
1061	      operator[](size_type __n) const _GLIBCXX_NOEXCEPT
[Current thread is 1 (Thread 0x7f9421599640 (LWP 4080918))]

I added some logs like this:

int src_buf_size = img.buf.size();
    for (i = 0; i < target_height; i++) {
        for (j = 0; j < target_width; j++) {
            x = (int)(tx * j);
            y = (int)(ty * i);

            dx = tx * j - x;
            dy = ty * i - y;

            for (k = 0; k < 3; k++) {
                for (jj = 0; jj <= 3; jj++) {
                    int temp = (clip(y - 1 + jj, 0, ny - 1) * nx + clip(x, 0, nx - 1)) * 3 + k;
                    if (temp >= src_buf_size) {
                        LOG_TEE("%s: temp %d, src_buf_size %d\n", __func__, temp, src_buf_size);
                    }

                    d0 = img.buf[(clip(y - 1 + jj, 0, ny - 1) * nx + clip(x - 1, 0, nx - 1)) * 3 + k] - img.buf[(clip(y - 1 + jj, 0, ny - 1) * nx + clip(x, 0, nx - 1)) * 3 + k];
                    d2 = img.buf[(clip(y - 1 + jj, 0, ny - 1) * nx + clip(x + 1, 0, nx - 1)) * 3 + k] - img.buf[(clip(y - 1 + jj, 0, ny - 1) * nx + clip(x, 0, nx - 1)) * 3 + k];
                    d3 = img.buf[(clip(y - 1 + jj, 0, ny - 1) * nx + clip(x + 2, 0, nx - 1)) * 3 + k] - img.buf[(clip(y - 1 + jj, 0, ny - 1) * nx + clip(x, 0, nx - 1)) * 3 + k];
                    a0 = img.buf[(clip(y - 1 + jj, 0, ny - 1) * nx + clip(x, 0, nx - 1)) * 3 + k];                     

it outputs:

bicubic_resize: temp 5113152, src_buf_size 5092990

does this mean it will cause the access of img.buf[] in following lines will cause invalid access?

gryffindor-rr avatar Aug 29 '24 08:08 gryffindor-rr