Skip to content

server: /infill ignores invalid prompt arrays and returns success #57

Open

Description

@am17an

Upstream: ggml-org#29458

/infill accepts a non-string prompt with HTTP 200 instead of returning its intended validation error, silently dropping the field.

Confirmed on Spark Linux ARM64 CPU, upstream 4da6337767f973e2b4d0797e5b323d77d8565e4a, Qwen2.5-0.5B-Instruct Q4_K_M (-ngl 0 -c 1024 -np 1).

POST /infill:

{"input_prefix":"def f():","input_suffix":"return x","prompt":[152936],"n_predict":4,"temperature":0,"seed":1,"cache_prompt":false}

Observed: HTTP 200, 8 evaluated tokens. Controls with prompt:[-1], prompt:[9707], and no prompt all produce the identical formatted prompt and output. /v1/completions with {"model":"x","prompt":[152936],"max_tokens":4} returns 400 Prompt contains invalid tokens.

Cause: the non-string check calls res->error() but does not return. json_value<string> then replaces the array with an empty string and a later response returns success. This confirms broken validation, NOT the upstream claim that out-of-range IDs reach inference. Introducing commit not bisected.

Activity

  1. ServeurpersoCom commented on Sep 29, 2026

    @ServeurpersoCom

    Here's a small fix covering all three checks, could you give it a quick try? If it's good on your side I'll open the PR: ggml-org@501358a

    diff --git a/tools/server/server-context.cpp b/tools/server/server-context.cpp
    index c675f4c303..bfbf3fec5e 100644
    --- a/tools/server/server-context.cpp
    +++ b/tools/server/server-context.cpp
    @@ -4883,14 +4883,17 @@ void server_routes::init_routes() {
             if (data.contains("prompt") && !data.at("prompt").is_string()) {
                 // prompt is optional
                 res->error(format_error_response("\"prompt\" must be a string", ERROR_TYPE_INVALID_REQUEST));
    +            return res;
             }
    
             if (!data.contains("input_prefix")) {
                 res->error(format_error_response("\"input_prefix\" is required", ERROR_TYPE_INVALID_REQUEST));
    +            return res;
             }
    
             if (!data.contains("input_suffix")) {
                 res->error(format_error_response("\"input_suffix\" is required", ERROR_TYPE_INVALID_REQUEST));
    +            return res;
             }
    
             if (data.contains("input_extra") && !data.at("input_extra").is_array()) {
    
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't workingserver

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions