Skip to content

Double-free crash in  console::history_t::~history_t()  on Termux (Android aarch64 bionic libc) #27065

Closed as not planned
Closed as not planned
Double-free crash in  console::history_t::~history_t()  on Termux (Android aarch64 bionic libc)#27065
Labels
stale

Description

@1234562026
1234562026
opened on Aug 14, 2026

Environment

  • Platform: Android aarch64 (Termux)
  • libc: bionic (Android libc)
  • Build type: Debug build with AddressSanitizer
  • Build command: cmake -B build -DCMAKE_BUILD_TYPE=Debug -DGGML_SANITIZE_ADDRESS=ON && cmake --build build

Reproduction Steps

  1. Build llama.cpp with ASAN under Termux
  2. Run ./build/bin/llama-cli -m your_model.gguf
  3. Enter interactive chat, send any prompt
  4. After inference completes, program crashes on exit

Crash Info

ASAN summary:
AddressSanitizer: double-free common/console.cpp:699:12 in console::history_t::~history_t()

Critical observation

  • Crash only occurs in interactive readline mode
  • When launching with --no-interactive (single-shot prompt without readline console), double-free crash does NOT reproduce.
  • This bug is isolated to console history management code, unrelated to GGUF parsing or ggml inference logic.
  • Cannot reproduce on standard glibc Linux, appears specific to bionic libc static global destruction ordering.

ASAN Shortened Stack Trace

Translation:
"Multiple segmentation faults have occurred here."

Or more concisely:
"Segmentation faults occurred here multiple times."

Error generated when no parameters are provided. log1 ~/.../build/bin $ ./llama-cli AddressSanitizer:DEADLYSIGNAL ================================================================= ==21408==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x000000000000 bp 0x007fc560dee0 sp 0x007fc560dee0 T0) ==21408==Hint: pc points to the zero page. ==21408==The signal is caused by a READ memory access. ==21408==Hint: address points to the zero page. #0 0x000000000000 () #1 0x0077678dde0c (/data/data/com.termux/files/usr/lib/libc++_shared.so+0x9ce0c) (BuildId: ba615e4ff75bc2d8ba1eee93f983e02bc427c433) #2 0x0077678ff454 in __gxx_personality_v0 (/data/data/com.termux/files/usr/lib/libc++_shared.so+0xbe454) (BuildId: ba615e4ff75bc2d8ba1eee93f983e02bc427c433) #3 0x007768461130 in _Unwind_RaiseException_Phase2 unwind-dw2.c #4 0x007768461638 in _Unwind_Resume (/apex/com.android.runtime/lib64/bionic/libc.so+0x4a638) (BuildId: 9b519826b14a28460dfd61a3015d69be) #5 0x007765a969a0 in common_params_parse_ex(int, char**, common_params_context&) /data/data/com.termux/files/home/llama.cpp/common/arg.cpp #6 0x007765a945c8 in common_params_parse(int, char**, common_params&, llama_example, void (*)(int, char**)) /data/data/com.termux/files/home/llama.cpp/common/arg.cpp:1291:14 #7 0x00776522e03c in llama_cli(int, char**) (/data/data/com.termux/files/usr/lib/libllama-cli-impl.so+0x2703c) #8 0x0056c87fab84 in main /data/data/com.termux/files/home/llama.cpp/tools/cli/main.cpp:4:12 #9 0x00776849be70 in __libc_init (/apex/com.android.runtime/lib64/bionic/libc.so+0x84e70) (BuildId: 9b519826b14a28460dfd61a3015d69be) #10 0x0056c8753138 in _start_main crtbegin.c

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV ()
==21408==ABORTING
Aborted ./llama-cli
~/.../build/bin $

"File not found causes a segmentation fault."

Or more formally: "The absence of
the file results in a segmentation
fault."


log2
~/.../build/bin $ ./llama-cli -m 家目录的模型文件

Loading model... |0.00.033.171 E gguf_init_from_file: failed to open GGUF file '家目录的模型文件' (No such file or directory)
0.00.033.421 E llama_model_load: error loading model: llama_model_loader: failed to load model from 家目录的模型文件
0.00.033.449 E llama_model_load_from_file_impl: failed to load model
AddressSanitizer:DEADLYSIGNAL

==22479==ERROR: AddressSanitizer: BUS on unknown address (pc 0x001ec361e7e5 bp 0x00761b0f2b20 sp 0x00761b0f2b20 T5)
==22479==The signal is caused by a READ memory access.
==22479==Hint: this fault was caused by a dereference of a high value address (see register values below). Disassemble the provided pc to learn which register was used.
==22479==Hint: PC is at a non-executable region. Maybe a wild jump?
\ #0 0x001ec361e7e5 ()
#1 0x0076a1b64e0c (/data/data/com.termux/files/usr/lib/libc++_shared.so+0x9ce0c) (BuildId: ba615e4ff75bc2d8ba1eee93f983e02bc427c433)
#2 0x0076a1b86454 in __gxx_personality_v0 (/data/data/com.termux/files/usr/lib/libc++_shared.so+0xbe454) (BuildId: ba615e4ff75bc2d8ba1eee93f983e02bc427c433)
#3 0x00769fc94130 in _Unwind_RaiseException_Phase2 unwind-dw2.c
#4 0x00769fc94638 in _Unwind_Resume (/apex/com.android.runtime/lib64/bionic/libc.so+0x4a638) (BuildId: 9b519826b14a28460dfd61a3015d69be)
#5 0x0076a0c61204 in common_params_fit_impl(char const*, llama_model_params*, llama_context_params*, float*, llama_model_tensor_buft_override*, unsigned long*, unsigned int, ggml_log_level) /data/data/com.termux/files/home/llama.cpp/common/fit.cpp
#6 0x0076a0c593a8 in common_fit_params(char const*, llama_model_params*, llama_context_params*, float*, llama_model_tensor_buft_override*, unsigned long*, unsigned int, ggml_log_level) /data/data/com.termux/files/home/llama.cpp/common/fit.cpp:803:9
#7 0x0076a0bc0950 in common_init_result::common_init_result(common_params&, bool) /data/data/com.termux/files/home/llama.cpp/common/common.cpp:1295:9
#8 0x0076a0bc4618 in common_init_from_params(common_params&, bool) /data/data/com.termux/files/home/llama.cpp/common/common.cpp:1407:36
#9 0x0076a2ffaa24 in server_context_impl::load_model(common_params&) (/data/data/com.termux/files/usr/lib/libllama-server-impl.so+0x590a24)
#10 0x0076a2e98da8 in llama_server(common_params&, int, char**) (/data/data/com.termux/files/usr/lib/libllama-server-impl.so+0x42eda8)
#11 0x0076a2a17a2c (/data/data/com.termux/files/usr/lib/libllama-cli-impl.so+0x46a2c)
#12 0x006507bac920 in asan_thread_start(void*) /home/builder/.termux-build/libllvm/src/compiler-rt/lib/asan/asan_interceptors.cpp:239:28
#13 0x00769fcd5b0c in __start_thread clone.cpp

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: BUS ()
Thread T5 created by T0 here:
#0 0x006507b9b0f8 in pthread_create /home/builder/.termux-build/libllvm/src/compiler-rt/lib/asan/asan_interceptors.cpp:250:3
#1 0x0076a2a17948 (/data/data/com.termux/files/usr/lib/libllama-cli-impl.so+0x46948)
#2 0x0076a2a0f040 in cli_server::start(common_params&) (/data/data/com.termux/files/usr/lib/libllama-cli-impl.so+0x3e040)
#3 0x0076a29ff384 in cli_context::init() (/data/data/com.termux/files/usr/lib/libllama-cli-impl.so+0x2e384)
#4 0x0076a29f80a0 in llama_cli(int, char**) (/data/data/com.termux/files/usr/lib/libllama-cli-impl.so+0x270a0)
#5 0x006507be8b84 in main /data/data/com.termux/files/home/llama.cpp/tools/cli/main.cpp:4:12
#6 0x00769fccee70 in __libc_init (/apex/com.android.runtime/lib64/bionic/libc.so+0x84e70) (BuildId: 9b519826b14a28460dfd61a3015d69be)
#7 0x006507b41138 in _start_main crtbegin.c

==22479==ABORTING
Aborted ./llama-cli -m 家目录的模型文件

Segmentation fault occurred after loading the model and starting a dialogue.

Or more concisely:
Segmentation fault after loading
model dialogue.


log3

在吗

=================================================================
==22646==ERROR: AddressSanitizer: attempting double-free on 0x00408813f450 in thread T0:

/data/data/com.termux/files/usr/bin/llvm-symbolizer: error: '[vdso]': No such file or directory
#0 0x005e87fba3d4 in operator delete(void*, unsigned long) /home/builder/.termux-build/libllvm/src/compiler-rt/lib/asan/asan_new_delete.cpp:190:3
#1 0x007c17d39424 in void std::__ndk1::__libcpp_operator_delete[abi:ne210000]<std::__ndk1::basic_string<char, std::__ndk1::char_traits, std::__ndk1::allocator>, unsigned long>(std::__ndk1::basic_string<char, std::__ndk1::char_traits, std::__ndk1::allocator>, unsigned long) /data/data/com.termux/files/usr/bin/../../usr/include/c++/v1/__new/allocate.h:46:3
#2 0x007c17d393b8 in void std::__ndk1::__libcpp_deallocate[abi:ne210000]<std::__ndk1::basic_string<char, std::__ndk1::char_traits, std::__ndk1::allocator>>(std::__ndk1::__type_identity<std::__ndk1::basic_string<char, std::__ndk1::char_traits, std::__ndk1::allocator>>::type*, std::__ndk1::__element_count, unsigned long) /data/data/com.termux/files/usr/bin/../../usr/include/c++/v1/__new/allocate.h:86:12
#3 0x007c17d39344 in std::__ndk1::allocator<std::__ndk1::basic_string<char, std::__ndk1::char_traits, std::__ndk1::allocator>>::deallocate[abi:ne210000](std::__ndk1::basic_string<char, std::__ndk1::char_traits, std::__ndk1::allocator>, unsigned long) /data/data/com.termux/files/usr/bin/../../usr/include/c++/v1/__memory/allocator.h:120:7
#4 0x007c17d390f8 in std::__ndk1::allocator_traits<std::__ndk1::allocator<std::__ndk1::basic_string<char, std::__ndk1::char_traits, std::__ndk1::allocator>>>::deallocate[abi:ne210000](std::__ndk1::allocator<std::__ndk1::basic_string<char, std::__ndk1::char_traits, std::__ndk1::allocator>>&, std::__ndk1::basic_string<char, std::__ndk1::char_traits, std::__ndk1::allocator>, unsigned long) /data/data/com.termux/files/usr/bin/../../usr/include/c++/v1/__memory/allocator_traits.h:302:9
#5 0x007c17d45460 in std::__ndk1::vector<std::__ndk1::basic_string<char, std::__ndk1::char_traits, std::__ndk1::allocator>, std::__ndk1::allocator<std::__ndk1::basic_string<char, std::__ndk1::char_traits, std::__ndk1::allocator>>>::__destroy_vector::operator()abi:ne210000 /data/data/com.termux/files/usr/bin/../../usr/include/c++/v1/__vector/vector.h:250:9
#6 0x007c17d1caf4 in std::__ndk1::vector<std::__ndk1::basic_string<char, std::__ndk1::char_traits, std::__ndk1::allocator>, std::__ndk1::allocator<std::__ndk1::basic_string<char, std::__ndk1::char_traits, std::__ndk1::allocator>>>::~vectorabi:ne210000 /data/data/com.termux/files/usr/bin/../../usr/include/c++/v1/__vector/vector.h:259:67
#7 0x007c181369a8 in console::history_t::~history_t() /data/data/com.termux/files/home/llama.cpp/common/console.cpp:699:12
#8 0x007c1725b6bc in __cxa_finalize (/apex/com.android.runtime/lib64/bionic/libc.so+0xee6bc) (BuildId: 9b519826b14a28460dfd61a3015d69be)
#9 0x007c17256810 in exit (/apex/com.android.runtime/lib64/bionic/libc.so+0xe9810) (BuildId: 9b519826b14a28460dfd61a3015d69be)
#10 0x007c191701a4 (/data/data/com.termux/files/usr/lib/libllama-cli-impl.so+0x271a4)
#11 0x007c1dcdf624 ([vdso]+0x624) (BuildId: 4f3880c3a1976df3)
#12 0x007c172446f4 in __ppoll __set_errno.cpp
#13 0x007c17202b3c in poll (/apex/com.android.runtime/lib64/bionic/libc.so+0x95b3c) (BuildId: 9b519826b14a28460dfd61a3015d69be)
#14 0x005e87f4895c in poll /home/builder/.termux-build/libllvm/src/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:4296:13
#15 0x007c199248ec in httplib::detail::SocketStream::wait_readable() const (/data/data/com.termux/files/usr/lib/libllama-server-impl.so+0x6438ec)
#16 0x007c19924b68 in httplib::detail::SocketStream::read(char*, unsigned long) (/data/data/com.termux/files/usr/lib/libllama-server-impl.so+0x643b68)
#17 0x007c1990d45c in httplib::detail::stream_line_reader::getline() (/data/data/com.termux/files/usr/lib/libllama-server-impl.so+0x62c45c)
#18 0x007c1992359c in httplib::detail::ChunkedDecoder::read_payload(char*, unsigned long, unsigned long&, unsigned long&) (/data/data/com.termux/files/usr/lib/libllama-server-impl.so+0x64259c)
#19 0x007c19982014 in httplib::detail::ReadContentResult httplib::detail::read_content_chunkedhttplib::Response(httplib::Stream&, httplib::Response&, unsigned long, std::__ndk1::function<bool (char const*, unsigned long, unsigned long, unsigned long)>) (/data/data/com.termux/files/usr/lib/libllama-server-impl.so+0x6a1014)
#20 0x007c1998185c in bool httplib::detail::read_contenthttplib::Response(httplib::Stream&, httplib::Response&, unsigned long, int&, std::__ndk1::function<bool (unsigned long, unsigned long)>, std::__ndk1::function<bool (char const*, unsigned long, unsigned long, unsigned long)>, bool)::'lambda'(std::__ndk1::function<bool (char const*, unsigned long, unsigned long, unsigned long)> const&)::operator()(std::__ndk1::function<bool (char const*, unsigned long, unsigned long, unsigned long)> const&) const (/data/data/com.termux/files/usr/lib/libllama-server-impl.so+0x6a085c)
#21 0x007c19981550 in bool httplib::detail::prepare_content_receiver<httplib::Response, bool httplib::detail::read_contenthttplib::Response(httplib::Stream&, httplib::Response&, unsigned long, int&, std::__ndk1::function<bool (unsigned long, unsigned long)>, std::__ndk1::function<bool (char const*, unsigned long, unsigned long, unsigned long)>, bool)::'lambda'(std::__ndk1::function<bool (char const*, unsigned long, unsigned long, unsigned long)> const&)>(httplib::Response&, int&, std::__ndk1::function<bool (char const*, unsigned long, unsigned long, unsigned long)>, bool, unsigned long, bool&, bool httplib::detail::read_contenthttplib::Response(httplib::Stream&, httplib::Response&, unsigned long, int&, std::__ndk1::function<bool (unsigned long, unsigned long)>, std::__ndk1::function<bool (char const*, unsigned long, unsigned long, unsigned long)>, bool)::'lambda'(std::__ndk1::function<bool (char const*, unsigned long, unsigned long, unsigned long)> const&)) (/data/data/com.termux/files/usr/lib/libllama-server-impl.so+0x6a0550)
#22 0x007c19970d98 in bool httplib::detail::read_contenthttplib::Response(httplib::Stream&, httplib::Response&, unsigned long, int&, std::__ndk1::function<bool (unsigned long, unsigned long)>, std::__ndk1::function<bool (char const*, unsigned long, unsigned long, unsigned long)>, bool) (/data/data/com.termux/files/usr/lib/libllama-server-impl.so+0x68fd98)
#23 0x007c19939c08 in httplib::ClientImpl::process_request(httplib::Stream&, httplib::Request&, httplib::Response&, bool, httplib::Error&) (/data/data/com.termux/files/usr/lib/libllama-server-impl.so+0x658c08)
#24 0x007c19938c44 in httplib::ClientImpl::handle_request(httplib::Stream&, httplib::Request&, httplib::Response&, bool, httplib::Error&) (/data/data/com.termux/files/usr/lib/libllama-server-impl.so+0x657c44)
#25 0x007c1993d460 in httplib::ClientImpl::process_socket(httplib::ClientImpl::Socket const&, std::__ndk1::chrono::time_point<std::__ndk1::chrono::steady_clock, std::__ndk1::chrono::duration<long long, std::__ndk1::ratio<1l, 1000000000l>>>, std::ndk1::function<bool (httplib::Stream&)>) (/data/data/com.termux/files/usr/lib/libllama-server-impl.so+0x65c460)
#26 0x007c19936f00 in httplib::ClientImpl::send(httplib::Request&, httplib::Response&, httplib::Error&) (/data/data/com.termux/files/usr/lib/libllama-server-impl.so+0x655f00)
#27 0x007c199373e4 in httplib::ClientImpl::send(httplib::Request&&) (/data/data/com.termux/files/usr/lib/libllama-server-impl.so+0x6563e4)
#28 0x007c19942ab8 in httplib::ClientImpl::Post(std::__ndk1::basic_string<char, std::__ndk1::char_traits, std::__ndk1::allocator> const&, httplib::detail::insertion_ordered_multimap<std::__ndk1::basic_string<char, std::__ndk1::char_traits, std::__ndk1::allocator>, httplib::detail::case_ignore::equal_to> const&, std::__ndk1::basic_string<char, std::__ndk1::char_traits, std::__ndk1::allocator> const&, std::__ndk1::basic_string<char, std::__ndk1::char_traits, std::__ndk1::allocator> const&, std::__ndk1::function<bool (char const*, unsigned long)>, std::__ndk1::function<bool (unsigned long, unsigned long)>) (/data/data/com.termux/files/usr/lib/libllama-server-impl.so+0x661ab8)
#29 0x007c1994f5e8 in httplib::Client::Post(std::__ndk1::basic_string<char, std::__ndk1::char_traits, std::__ndk1::allocator> const&, httplib::detail::insertion_ordered_multimap<std::__ndk1::basic_string<char, std::__ndk1::char_traits, std::__ndk1::allocator>, httplib::detail::case_ignore::equal_to> const&, std::__ndk1::basic_string<char, std::__ndk1::char_traits, std::__ndk1::allocator> const&, std::__ndk1::basic_string<char, std::__ndk1::char_traits, std::__ndk1::allocator> const&, std::__ndk1::function<bool (char const*, unsigned long)>, std::__ndk1::function<bool (unsigned long, unsigned long)>) (/data/data/com.termux/files/usr/lib/libllama-server-impl.so+0x66e5e8)
#30 0x007c19175048 in cli_client::post_sse(std::__ndk1::basic_string<char, std::__ndk1::char_traits, std::__ndk1::allocator> const&, std::__ndk1::basic_string<char, std::__ndk1::char_traits, std::__ndk1::allocator> const&, std::__ndk1::function<bool ()> const&, std::__ndk1::function<void (std::__ndk1::basic_string<char, std::__ndk1::char_traits, std::__ndk1::allocator> const&)> const&) (/data/data/com.termux/files/usr/lib/libllama-cli-impl.so+0x2c048)
#31 0x007c1917dd60 in cli_context::generate_completion(cli_context::generated_content&, cli_timings&) (/data/data/com.termux/files/usr/lib/libllama-cli-impl.so+0x34d60)
#32 0x007c1917f418 in cli_context::run() (/data/data/com.termux/files/usr/lib/libllama-cli-impl.so+0x36418)
#33 0x007c191700ac in llama_cli(int, char**) (/data/data/com.termux/files/usr/lib/libllama-cli-impl.so+0x270ac)
#34 0x005e87fbab84 in main /data/data/com.termux/files/home/llama.cpp/tools/cli/main.cpp:4:12
#35 0x007c171f1e70 in __libc_init (/apex/com.android.runtime/lib64/bionic/libc.so+0x84e70) (BuildId: 9b519826b14a28460dfd61a3015d69be)

0x00408813f450 is located 0 bytes inside of 24-byte region [0x00408813f450,0x00408813f468)
freed by thread T0 here:
#0 0x005e87fba3d4 in operator delete(void*, unsigned long) /home/builder/.termux-build/libllvm/src/compiler-rt/lib/asan/asan_new_delete.cpp:190:3
#1 0x007c17d39424 in void std::__ndk1::__libcpp_operator_delete[abi:ne210000]<std::__ndk1::basic_string<char, std::__ndk1::char_traits, std::__ndk1::allocator>, unsigned long>(std::__ndk1::basic_string<char, std::__ndk1::char_traits, std::__ndk1::allocator>, unsigned long) /data/data/com.termux/files/usr/bin/../../usr/include/c++/v1/__new/allocate.h:46:3
#2 0x007c17d393b8 in void std::__ndk1::__libcpp_deallocate[abi:ne210000]<std::__ndk1::basic_string<char, std::__ndk1::char_traits, std::__ndk1::allocator>>(std::__ndk1::__type_identity<std::__ndk1::basic_string<char, std::__ndk1::char_traits, std::__ndk1::allocator>>::type*, std::__ndk1::__element_count, unsigned long) /data/data/com.termux/files/usr/bin/../../usr/include/c++/v1/__new/allocate.h:86:12
#3 0x007c17d39344 in std::__ndk1::allocator<std::__ndk1::basic_string<char, std::__ndk1::char_traits, std::__ndk1::allocator>>::deallocate[abi:ne210000](std::__ndk1::basic_string<char, std::__ndk1::char_traits, std::__ndk1::allocator>, unsigned long) /data/data/com.termux/files/usr/bin/../../usr/include/c++/v1/__memory/allocator.h:120:7
#4 0x007c17d390f8 in std::__ndk1::allocator_traits<std::__ndk1::allocator<std::__ndk1::basic_string<char, std::__ndk1::char_traits, std::__ndk1::allocator>>>::deallocate[abi:ne210000](std::__ndk1::allocator<std::__ndk1::basic_string<char, std::__ndk1::char_traits, std::__ndk1::allocator>>&, std::__ndk1::basic_string<char, std::__ndk1::char_traits, std::__ndk1::allocator>, unsigned long) /data/data/com.termux/files/usr/bin/../../usr/include/c++/v1/__memory/allocator_traits.h:302:9
#5 0x007c17d45460 in std::__ndk1::vector<std::__ndk1::basic_string<char, std::__ndk1::char_traits, std::__ndk1::allocator>, std::__ndk1::allocator<std::__ndk1::basic_string<char, std::__ndk1::char_traits, std::__ndk1::allocator>>>::__destroy_vector::operator()abi:ne210000 /data/data/com.termux/files/usr/bin/../../usr/include/c++/v1/__vector/vector.h:250:9
#6 0x007c17d1caf4 in std::__ndk1::vector<std::__ndk1::basic_string<char, std::__ndk1::char_traits, std::__ndk1::allocator>, std::__ndk1::allocator<std::__ndk1::basic_string<char, std::__ndk1::char_traits, std::__ndk1::allocator>>>::~vectorabi:ne210000 /data/data/com.termux/files/usr/bin/../../usr/include/c++/v1/__vector/vector.h:259:67
#7 0x007c181369a8 in console::history_t::~history_t() /data/data/com.termux/files/home/llama.cpp/common/console.cpp:699:12
#8 0x007c1725b6bc in __cxa_finalize (/apex/com.android.runtime/lib64/bionic/libc.so+0xee6bc) (BuildId: 9b519826b14a28460dfd61a3015d69be)
#9 0x007c17256810 in exit (/apex/com.android.runtime/lib64/bionic/libc.so+0xe9810) (BuildId: 9b519826b14a28460dfd61a3015d69be)
#10 0x007c191701a4 (/data/data/com.termux/files/usr/lib/libllama-cli-impl.so+0x271a4)
#11 0x007c1dcdf624 ([vdso]+0x624) (BuildId: 4f3880c3a1976df3)
#12 0x007c17202b3c in poll (/apex/com.android.runtime/lib64/bionic/libc.so+0x95b3c) (BuildId: 9b519826b14a28460dfd61a3015d69be)
#13 0x005e87f4895c in poll /home/builder/.termux-build/libllvm/src/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:4296:13
#14 0x007c199248ec in httplib::detail::SocketStream::wait_readable() const (/data/data/com.termux/files/usr/lib/libllama-server-impl.so+0x6438ec)
#15 0x007c19924b68 in httplib::detail::SocketStream::read(char*, unsigned long) (/data/data/com.termux/files/usr/lib/libllama-server-impl.so+0x643b68)
#16 0x007c1990d45c in httplib::detail::stream_line_reader::getline() (/data/data/com.termux/files/usr/lib/libllama-server-impl.so+0x62c45c)
#17 0x007c1992359c in httplib::detail::ChunkedDecoder::read_payload(char*, unsigned long, unsigned long&, unsigned long&) (/data/data/com.termux/files/usr/lib/libllama-server-impl.so+0x64259c)
#18 0x007c19982014 in httplib::detail::ReadContentResult httplib::detail::read_content_chunkedhttplib::Response(httplib::Stream&, httplib::Response&, unsigned long, std::__ndk1::function<bool (char const*, unsigned long, unsigned long, unsigned long)>) (/data/data/com.termux/files/usr/lib/libllama-server-impl.so+0x6a1014)
#19 0x007c1998185c in bool httplib::detail::read_contenthttplib::Response(httplib::Stream&, httplib::Response&, unsigned long, int&, std::__ndk1::function<bool (unsigned long, unsigned long)>, std::__ndk1::function<bool (char const*, unsigned long, unsigned long, unsigned long)>, bool)::'lambda'(std::__ndk1::function<bool (char const*, unsigned long, unsigned long, unsigned long)> const&)::operator()(std::__ndk1::function<bool (char const*, unsigned long, unsigned long, unsigned long)> const&) const (/data/data/com.termux/files/usr/lib/libllama-server-impl.so+0x6a085c)
#20 0x007c19981550 in bool httplib::detail::prepare_content_receiver<httplib::Response, bool httplib::detail::read_contenthttplib::Response(httplib::Stream&, httplib::Response&, unsigned long, int&, std::__ndk1::function<bool (unsigned long, unsigned long)>, std::__ndk1::function<bool (char const*, unsigned long, unsigned long, unsigned long)>, bool)::'lambda'(std::__ndk1::function<bool (char const*, unsigned long, unsigned long, unsigned long)> const&)>(httplib::Response&, int&, std::__ndk1::function<bool (char const*, unsigned long, unsigned long, unsigned long)>, bool, unsigned long, bool&, bool httplib::detail::read_contenthttplib::Response(httplib::Stream&, httplib::Response&, unsigned long, int&, std::__ndk1::function<bool (unsigned long, unsigned long)>, std::__ndk1::function<bool (char const*, unsigned long, unsigned long, unsigned long)>, bool)::'lambda'(std::__ndk1::function<bool (char const*, unsigned long, unsigned long, unsigned long)> const&)) (/data/data/com.termux/files/usr/lib/libllama-server-impl.so+0x6a0550)
#21 0x007c19970d98 in bool httplib::detail::read_contenthttplib::Response(httplib::Stream&, httplib::Response&, unsigned long, int&, std::__ndk1::function<bool (unsigned long, unsigned long)>, std::__ndk1::function<bool (char const*, unsigned long, unsigned long, unsigned long)>, bool) (/data/data/com.termux/files/usr/lib/libllama-server-impl.so+0x68fd98)
#22 0x007c19939c08 in httplib::ClientImpl::process_request(httplib::Stream&, httplib::Request&, httplib::Response&, bool, httplib::Error&) (/data/data/com.termux/files/usr/lib/libllama-server-impl.so+0x658c08)
#23 0x007c19938c44 in httplib::ClientImpl::handle_request(httplib::Stream&, httplib::Request&, httplib::Response&, bool, httplib::Error&) (/data/data/com.termux/files/usr/lib/libllama-server-impl.so+0x657c44)
#24 0x007c1993d460 in httplib::ClientImpl::process_socket(httplib::ClientImpl::Socket const&, std::__ndk1::chrono::time_point<std::__ndk1::chrono::steady_clock, std::__ndk1::chrono::duration<long long, std::__ndk1::ratio<1l, 1000000000l>>>, std::ndk1::function<bool (httplib::Stream&)>) (/data/data/com.termux/files/usr/lib/libllama-server-impl.so+0x65c460)
#25 0x007c19936f00 in httplib::ClientImpl::send(httplib::Request&, httplib::Response&, httplib::Error&) (/data/data/com.termux/files/usr/lib/libllama-server-impl.so+0x655f00)
#26 0x007c199373e4 in httplib::ClientImpl::send(httplib::Request&&) (/data/data/com.termux/files/usr/lib/libllama-server-impl.so+0x6563e4)
#27 0x007c19942ab8 in httplib::ClientImpl::Post(std::__ndk1::basic_string<char, std::__ndk1::char_traits, std::__ndk1::allocator> const&, httplib::detail::insertion_ordered_multimap<std::__ndk1::basic_string<char, std::__ndk1::char_traits, std::__ndk1::allocator>, httplib::detail::case_ignore::equal_to> const&, std::__ndk1::basic_string<char, std::__ndk1::char_traits, std::__ndk1::allocator> const&, std::__ndk1::basic_string<char, std::__ndk1::char_traits, std::__ndk1::allocator> const&, std::__ndk1::function<bool (char const*, unsigned long)>, std::__ndk1::function<bool (unsigned long, unsigned long)>) (/data/data/com.termux/files/usr/lib/libllama-server-impl.so+0x661ab8)
#28 0x007c1994f5e8 in httplib::Client::Post(std::__ndk1::basic_string<char, std::__ndk1::char_traits, std::__ndk1::allocator> const&, httplib::detail::insertion_ordered_multimap<std::__ndk1::basic_string<char, std::__ndk1::char_traits, std::__ndk1::allocator>, httplib::detail::case_ignore::equal_to> const&, std::__ndk1::basic_string<char, std::__ndk1::char_traits, std::__ndk1::allocator> const&, std::__ndk1::basic_string<char, std::__ndk1::char_traits, std::__ndk1::allocator> const&, std::__ndk1::function<bool (char const*, unsigned long)>, std::__ndk1::function<bool (unsigned long, unsigned long)>) (/data/data/com.termux/files/usr/lib/libllama-server-impl.so+0x66e5e8)
#29 0x007c19175048 in cli_client::post_sse(std::__ndk1::basic_string<char, std::__ndk1::char_traits, std::__ndk1::allocator> const&, std::__ndk1::basic_string<char, std::__ndk1::char_traits, std::__ndk1::allocator> const&, std::__ndk1::function<bool ()> const&, std::__ndk1::function<void (std::__ndk1::basic_string<char, std::__ndk1::char_traits, std::__ndk1::allocator> const&)> const&) (/data/data/com.termux/files/usr/lib/libllama-cli-impl.so+0x2c048)

previously allocated by thread T0 here:
#0 0x005e87fb9794 in operator new(unsigned long) /home/builder/.termux-build/libllvm/src/compiler-rt/lib/asan/asan_new_delete.cpp:109:35
#1 0x007c17d2ebe8 in void* std::__ndk1::__libcpp_operator_new[abi:ne210000](unsigned long) /data/data/com.termux/files/usr/bin/../../usr/include/c++/v1/__new/allocate.h:37:10
#2 0x007c17d38dd0 in std::__ndk1::basic_string<char, std::__ndk1::char_traits, std::__ndk1::allocator>* std::__ndk1::__libcpp_allocate[abi:ne210000]<std::__ndk1::basic_string<char, std::__ndk1::char_traits, std::__ndk1::allocator>>(std::__ndk1::__element_count, unsigned long) /data/data/com.termux/files/usr/bin/../../usr/include/c++/v1/__new/allocate.h:64:28
#3 0x007c17d38d64 in std::__ndk1::allocator<std::__ndk1::basic_string<char, std::__ndk1::char_traits, std::__ndk1::allocator>>::allocate[abi:ne210000](unsigned long) /data/data/com.termux/files/usr/bin/../../usr/include/c++/v1/__memory/allocator.h:105:14
#4 0x007c17d38cfc in std::__ndk1::__allocation_result<std::__ndk1::allocator_traits<std::__ndk1::allocator<std::__ndk1::basic_string<char, std::__ndk1::char_traits, std::__ndk1::allocator>>>::pointer> std::__ndk1::__allocate_at_least[abi:ne210000]<std::__ndk1::allocator<std::__ndk1::basic_string<char, std::__ndk1::char_traits, std::__ndk1::allocator>>>(std::__ndk1::allocator<std::__ndk1::basic_string<char, std::__ndk1::char_traits, std::__ndk1::allocator>>&, unsigned long) /data/data/com.termux/files/usr/bin/../../usr/include/c++/v1/__memory/allocate_at_least.h:41:19
#5 0x007c17d38384 in std::__ndk1::__split_buffer<std::__ndk1::basic_string<char, std::__ndk1::char_traits, std::__ndk1::allocator>, std::__ndk1::allocator<std::__ndk1::basic_string<char, std::__ndk1::char_traits, std::__ndk1::allocator>>&>::__split_buffer(unsigned long, unsigned long, std::__ndk1::allocator<std::__ndk1::basic_string<char, std::__ndk1::char_traits, std::__ndk1::allocator>>&) /data/data/com.termux/files/usr/bin/../../usr/include/c++/v1/__split_buffer:325:25
#6 0x007c1813a59c in std::__ndk1::basic_string<char, std::__ndk1::char_traits, std::__ndk1::allocator>* std::__ndk1::vector<std::__ndk1::basic_string<char, std::__ndk1::char_traits, std::__ndk1::allocator>, std::__ndk1::allocator<std::__ndk1::basic_string<char, std::__ndk1::char_traits, std::__ndk1::allocator>>>::__emplace_back_slow_path<std::__ndk1::basic_string_view<char, std::__ndk1::char_traits>&>(std::__ndk1::basic_string_view<char, std::__ndk1::char_traits>&) /data/data/com.termux/files/usr/bin/../../usr/include/c++/v1/__vector/vector.h:1114:47
#7 0x007c1813a148 in std::__ndk1::basic_string<char, std::__ndk1::char_traits, std::__ndk1::allocator>& std::__ndk1::vector<std::__ndk1::basic_string<char, std::__ndk1::char_traits, std::__ndk1::allocator>, std::__ndk1::allocator<std::__ndk1::basic_string<char, std::__ndk1::char_traits, std::__ndk1::allocator>>>::emplace_back<std::__ndk1::basic_string_view<char, std::__ndk1::char_traits>&>(std::__ndk1::basic_string_view<char, std::__ndk1::char_traits>&) /data/data/com.termux/files/usr/bin/../../usr/include/c++/v1/__vector/vector.h:1136:13
#8 0x007c18137d88 in console::history_t::add(std::__ndk1::basic_string_view<char, std::__ndk1::char_traits>) /data/data/com.termux/files/home/llama.cpp/common/console.cpp:709:25
#9 0x007c18130dd4 in console::readline_advanced(std::__ndk1::basic_string<char, std::__ndk1::char_traits, std::__ndk1::allocator>&, bool) /data/data/com.termux/files/home/llama.cpp/common/console.cpp:1039:21
#10 0x007c1812ece8 in console::readline(std::__ndk1::basic_string<char, std::__ndk1::char_traits, std::__ndk1::allocator>&, bool) /data/data/com.termux/files/home/llama.cpp/common/console.cpp:1087:16
#11 0x007c1918a95c in ui::user_turn::read_input(bool, char const*) (/data/data/com.termux/files/usr/lib/libllama-cli-impl.so+0x4195c)
#12 0x007c1917f0fc in cli_context::run() (/data/data/com.termux/files/usr/lib/libllama-cli-impl.so+0x360fc)
#13 0x007c191700ac in llama_cli(int, char**) (/data/data/com.termux/files/usr/lib/libllama-cli-impl.so+0x270ac)
#14 0x005e87fbab84 in main /data/data/com.termux/files/home/llama.cpp/tools/cli/main.cpp:4:12
#15 0x007c171f1e70 in __libc_init (/apex/com.android.runtime/lib64/bionic/libc.so+0x84e70) (BuildId: 9b519826b14a28460dfd61a3015d69be)
#16 0x005e87f13138 in _start_main crtbegin.c

SUMMARY: AddressSanitizer: double-free /data/data/com.termux/files/home/llama.cpp/common/console.cpp:699:12 in console::history_t::~history_t()
==22646==ABORTING
Aborted ./llama-cli -m ~/Qwen2.5-3B-Instruct-Q4_K_M.gguf
~/.../build/bin $
~/.../build/bin $
~/.../build/bin $

Activity

  1. github-actions
    added
    stale
    on Sep 14, 2026

  2. github-actions commented on Sep 28, 2026

    @github-actions
    github-actionsBot
    on Sep 28, 2026 – with GitHub Actions
    Contributor

    This issue was closed because it has been inactive for 14 days since being marked as stale.

  3. github-actions
    closed this as not plannedon Sep 28, 2026

  4. 1234562026 commented on Sep 28, 2026

    @1234562026
    1234562026
    on Sep 28, 2026
    Author

    Just reopening this issue which was auto-closed by stale bot. The bug still exists, and reproduction information was already provided.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    stale

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions