mirror of
https://github.com/ggml-org/whisper.cpp.git
synced 2026-09-25 15:37:33 -05:00
Ben YounesandBen Younes
a722846cb6
* whisper : guard null source in buffer loader read callback whisper_init_from_buffer_with_params_no_state installs a read callback that copies from buf->buffer + current_offset. When the buffer is exhausted (or the supplied buffer is empty), size_to_copy is 0 and the source pointer can be null; passing a null pointer to memcpy is undefined behavior even for a zero-length copy (UBSan: 'null pointer passed as argument 2' at the memcpy). Loading a crafted/short model through the buffer loader could hit this. Skip the memcpy when there is nothing to copy. Loading from a null/empty or truncated buffer now fails gracefully (returns NULL) with no UB. This addresses bug 1 of #3879. Bug 2 (integer overflow when sizing the mel filter buffer) is covered by the open PR #3780. * fixup! whisper : guard null source in buffer loader read callback --------- Co-authored-by: Ben Younes <2910651+ousamabenyounes@users.noreply.github.com>
25 lines
622 B
C++
25 lines
622 B
C++
#include "whisper.h"
|
|
|
|
#include <cstdint>
|
|
#include <cstdio>
|
|
|
|
#ifdef NDEBUG
|
|
#undef NDEBUG
|
|
#endif
|
|
#include <cassert>
|
|
|
|
int main() {
|
|
struct whisper_context_params cparams = whisper_context_default_params();
|
|
cparams.use_gpu = false;
|
|
|
|
struct whisper_context * ctx_empty = whisper_init_from_buffer_with_params(nullptr, 1, cparams);
|
|
assert(ctx_empty == nullptr);
|
|
|
|
uint8_t truncated[8] = { 0 };
|
|
struct whisper_context * ctx_trunc = whisper_init_from_buffer_with_params(truncated, sizeof(truncated), cparams);
|
|
assert(ctx_trunc == nullptr);
|
|
|
|
printf("test-whisper-buffer-loader: OK\n");
|
|
return 0;
|
|
}
|