We Found a Heap Overflow in Llama.cpp's Tokenizer