From df1547b6fe362556e48fd21f386c6eee85b971fe Mon Sep 17 00:00:00 2001
From: Md Shafiuzzaman <mdshafiuzzaman@ucsb.edu>
Date: Thu, 6 Aug 2026 23:16:52 -0700
Subject: [PATCH] whisper,parakeet : reject invalid n_dims in tensor header to
 prevent stack-buffer-overflow on malformed model files (#3957)

* fix: reject invalid n_dims in    tensor header to prevent stack-buffer-overflow on malformed model files

* Validate n_dims value in model file loading

Add error handling for invalid n_dims in model file.
---
 src/parakeet.cpp |  5 +++++
 src/whisper.cpp  | 12 ++++++++++++
 2 files changed, 17 insertions(+)

diff --git a/src/parakeet.cpp b/src/parakeet.cpp
index 178f049b1..59ad5c739 100644
--- a/src/parakeet.cpp
+++ b/src/parakeet.cpp
@@ -1439,6 +1439,11 @@ static bool parakeet_model_load(struct parakeet_model_loader * loader, parakeet_
                 break;
             }
 
+            if (n_dims < 0 || n_dims > 4) {
+                  PARAKEET_LOG_ERROR("%s: invalid n_dims %d in model file (expected 0 <= n_dims <= 4)\n", __func__, n_dims);
+                  return false;
+            }
+
             int32_t nelements = 1;
             int32_t ne[4] = { 1, 1, 1, 1 };
             for (int i = 0; i < n_dims; ++i) {
diff --git a/src/whisper.cpp b/src/whisper.cpp
index 2a95bdb1e..4ac3b1104 100644
--- a/src/whisper.cpp
+++ b/src/whisper.cpp
@@ -1879,6 +1879,12 @@ static bool whisper_model_load(struct whisper_model_loader * loader, whisper_con
                 break;
             }
 
+             if (n_dims < 0 || n_dims > 4) {
+                  WHISPER_LOG_ERROR("%s: invalid n_dims %d in model file (expected 0 <= n_dims <= 4)\n", __func__, n_dims);
+                  return false;
+              }
+
+
             int32_t nelements = 1;
             int32_t ne[4] = { 1, 1, 1, 1 };
             for (int i = 0; i < n_dims; ++i) {
@@ -5021,6 +5027,12 @@ struct whisper_vad_context * whisper_vad_init_with_params(
                 break;
             }
 
+            if (n_dims < 0 || n_dims > 4) {
+                  WHISPER_LOG_ERROR("%s: invalid n_dims %d in model file (expected 0 <= n_dims <= 4)\n", __func__, n_dims);
+                  return nullptr;
+            }
+
+
             int32_t nelements = 1;
             int32_t ne[4] = { 1, 1, 1, 1 };
             for (int i = 0; i < n_dims; ++i) {