Skip to content

Fix malformed BPE merges panicking during build#2219

Open
0xzr wants to merge 1 commit into
huggingface:mainfrom
0xzr:fix/bpe-malformed-merge-panic
Open

Fix malformed BPE merges panicking during build#2219
0xzr wants to merge 1 commit into
huggingface:mainfrom
0xzr:fix/bpe-malformed-merge-panic

Conversation

@0xzr

@0xzr 0xzr commented Jul 19, 2026

Copy link
Copy Markdown

What does this PR do?

Malformed BPE merge definitions could panic in BpeBuilder::build before returning the existing MergeTokenOutOfVocabulary error:

  • a merge result longer than the longest vocabulary token overflowed the reusable scratch buffer
  • a continuing-subword prefix longer than the second merge token caused subtraction underflow

This validates the prefix slice and merged length before writing to the buffer. A result longer than every vocabulary token is necessarily out of vocabulary, so it can return the existing error without allocating a larger buffer or changing valid-model behavior.

Regression tests cover both panic paths.

Fixes #2198

Tests

  • make lint
  • HF='uvx --from huggingface_hub hf' make test

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

BPE build() panics on load for a crafted tokenizer.json (merge concatenation exceeds the scratch buffer)

1 participant