Misc. bug: infinite loop in server_tokens::push_back(server_tokens&) when the appended tokens contain media #29865

Name and Version

master @ 4ebdf2c (2026-10-02); also present in b10454 (4df29be)

Problem description

In tools/server/server-common.cpp, server_tokens::push_back(server_tokens & tokens) copies media chunks with a for loop that never advances its iterator:

// tools/server/server-common.cpp:553 (master)
if (tokens.has_mtmd) {
    GGML_ASSERT(has_mtmd);
    for (auto it = tokens.map_idx_to_media.begin(); it != tokens.map_idx_to_media.end(); ) {
        auto * chunk = tokens.map_idx_to_media[it->first].get();
        mtmd::input_chunk_ptr new_chunk(mtmd_input_chunk_copy(chunk));
        map_idx_to_media[start_idx + it->first] = std::move(new_chunk);
    }
}

The loop reads from tokens.map_idx_to_media and writes to this->map_idx_to_media, so it stays valid but is never incremented. If the appended server_tokens contains at least one media chunk, the loop never terminates.

As far as I can see the only caller is the rerank prompt formatting (server-common.cpp:1855, result.push_back(tokens)), so it would be reached by a rerank request whose input includes media on a multimodal model.

Suggested fix

-    for (auto it = tokens.map_idx_to_media.begin(); it != tokens.map_idx_to_media.end(); ) {
+    for (auto it = tokens.map_idx_to_media.begin(); it != tokens.map_idx_to_media.end(); ++it) {

Notes

Found by code reading; I have not reproduced the hang at runtime.