colibrì v1.6.2 — security release
Fixes six privately-reported memory-safety issues, all reachable from attacker-controlled input (a malicious model file / config.json, or the kimi_k3 SERVE stdin). Every fix validates at the trust boundary — no behavioural change on well-formed models or requests.
| Advisory | Engine / file | Class |
|---|---|---|
| GHSA-gf38-c8fx-ppvv | kimi_k3.c (SERVE)
| unbounded max_tok → signed overflow → heap OOB write
|
| GHSA-2qrj-xjmh-mv74 | json.h (shared)
| object key without quote check → heap OOB read |
| GHSA-w696-h9p7-6rgc | inkling.c (DMel audio)
| unvalidated mel_vocab_size/n_mel_bins → OOB read
|
| GHSA-7654-r78q-vc3r | deepseek_v4.c
| qk_rope_head_dim > index_head_dim → OOB read/write
|
| GHSA-9gjf-272q-4vv4 | deepseek_v4.c + DSpark
| global/sidecar tensors loaded without shape check → OOB read |
| GHSA-8p69-257x-6fp6 | DSpark drafter | MTP expert slab sized from expert 0 → heap overflow write |
Tensor-shape checks require >= expected (not exact equality), so a legitimately padded official checkpoint is never false-rejected.
Consolidated in #1018. Thanks to the reporter for the detailed advisories and proofs.
Also in this release (merged since v1.6.1)
- V4 serve telemetry: report the expert-matmul phase on the web dashboard (#890 / #1005)
- Assorted small fixes and dashboard/tooling improvements.
Note
The archive now packages c/v4_dsml.py (imported by the OpenAI server) — the first release since the DSML refactor needed it.
Upgrade recommended for anyone loading models from untrusted mirrors or bridging the kimi_k3 SERVE protocol to untrusted clients.