chatnul

confirmedupstream bugC++ · llama.cppInference & servingJuly 13, 2026

the question

Does llama_chat_apply_template NUL-terminate its output buffer when it is sized to exactly the returned byte count?

what came out

At exact fill (length == res) strncpy copies all res bytes and writes no NUL, yet the return contract says the buffer sufficed. A guard-page strlen faults at length=res and not at res+1, so a C or FFI caller treating it as a C string over-reads past the buffer.

method & receipts

Result: confirmed
Pre-registered — the prediction was written down and committed before the run.
Reproducible — one script re-runs the whole thing from scratch.
Tested — a correctness/benchmark suite ships alongside the code.

→ read the code and re-run it

github.com/v-code01/chatnul