public_git
/
whisper.cpp
mirror of https://github.com/ggml-org/whisper.cpp.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

whisper,parakeet : reject invalid n_dims in tensor header to prevent stack-buffer-overflow on malformed model files (#3957) 

* fix: reject invalid n_dims in    tensor header to prevent stack-buffer-overflow on malformed model files

* Validate n_dims value in model file loading

Add error handling for invalid n_dims in model file.
This commit is contained in:
Md Shafiuzzaman 2026-08-06 23:16:52 -07:00 committed by GitHub
parent 306c88f4d1
commit df1547b6fe
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 17 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/parakeet.cpp
View File

@ -1439,6 +1439,11 @@ static bool parakeet_model_load(struct parakeet_model_loader * loader, parakeet_
break;
}
if (n_dims < 0 || n_dims > 4) {
PARAKEET_LOG_ERROR("%s: invalid n_dims %d in model file (expected 0 <= n_dims <= 4)\n", __func__, n_dims);
return false;
}
int32_t nelements = 1;
int32_t ne[4] = { 1, 1, 1, 1 };
for (int i = 0; i < n_dims; ++i) {

12
src/whisper.cpp
View File

@ -1879,6 +1879,12 @@ static bool whisper_model_load(struct whisper_model_loader * loader, whisper_con
break;
}
if (n_dims < 0 || n_dims > 4) {
WHISPER_LOG_ERROR("%s: invalid n_dims %d in model file (expected 0 <= n_dims <= 4)\n", __func__, n_dims);
return false;
}
int32_t nelements = 1;
int32_t ne[4] = { 1, 1, 1, 1 };
for (int i = 0; i < n_dims; ++i) {
@ -5021,6 +5027,12 @@ struct whisper_vad_context * whisper_vad_init_with_params(
break;
}
if (n_dims < 0 || n_dims > 4) {
WHISPER_LOG_ERROR("%s: invalid n_dims %d in model file (expected 0 <= n_dims <= 4)\n", __func__, n_dims);
return nullptr;
}
int32_t nelements = 1;
int32_t ne[4] = { 1, 1, 1, 1 };
for (int i = 0; i < n_dims; ++i) {