whisper,parakeet : reject invalid n_dims in tensor header to prevent stack-buffer...

* fix: reject invalid n_dims in    tensor header to prevent stack-buffer-overflow on malformed model files

* Validate n_dims value in model file loading

Add error handling for invalid n_dims in model file.

diff --git a/src/parakeet.cpp b/src/parakeet.cpp
index 178f049b1bff7406dbaf2c5baa53a6224bd160cd..59ad5c739aeadef7f555cfda9e4458caf0dc5998 100644 (file)
--- a/src/parakeet.cpp
+++ b/src/parakeet.cpp
@@ -1439,6 +1439,11 @@ static bool parakeet_model_load(struct parakeet_model_loader * loader, parakeet_
                 break;
             }
 
+            if (n_dims < 0 || n_dims > 4) {
+                  PARAKEET_LOG_ERROR("%s: invalid n_dims %d in model file (expected 0 <= n_dims <= 4)\n", __func__, n_dims);
+                  return false;
+            }
+
             int32_t nelements = 1;
             int32_t ne[4] = { 1, 1, 1, 1 };
             for (int i = 0; i < n_dims; ++i) {

diff --git a/src/whisper.cpp b/src/whisper.cpp
index 2a95bdb1e8a872975820f6a7f4875d6490620bc3..4ac3b1104f3f64b07f269b10673de9e903903af4 100644 (file)
--- a/src/whisper.cpp
+++ b/src/whisper.cpp
@@ -1879,6 +1879,12 @@ static bool whisper_model_load(struct whisper_model_loader * loader, whisper_con
                 break;
             }
 
+             if (n_dims < 0 || n_dims > 4) {
+                  WHISPER_LOG_ERROR("%s: invalid n_dims %d in model file (expected 0 <= n_dims <= 4)\n", __func__, n_dims);
+                  return false;
+              }
+
+
             int32_t nelements = 1;
             int32_t ne[4] = { 1, 1, 1, 1 };
             for (int i = 0; i < n_dims; ++i) {
@@ -5021,6 +5027,12 @@ struct whisper_vad_context * whisper_vad_init_with_params(
                 break;
             }
 
+            if (n_dims < 0 || n_dims > 4) {
+                  WHISPER_LOG_ERROR("%s: invalid n_dims %d in model file (expected 0 <= n_dims <= 4)\n", __func__, n_dims);
+                  return nullptr;
+            }
+
+
             int32_t nelements = 1;
             int32_t ne[4] = { 1, 1, 1, 1 };
             for (int i = 0; i < n_dims; ++i) {