From: Md Shafiuzzaman <redacted>
Date: Fri, 7 Aug 2026 06:16:52 +0000 (-0700)
Subject: whisper,parakeet : reject invalid n_dims in tensor header to prevent stack-buffer... 
X-Git-Url: https://git.djapps.eu/?a=commitdiff_plain;h=df1547b6fe362556e48fd21f386c6eee85b971fe;p=pkg%2Fggml%2Fsources%2Fwhisper.cpp

whisper,parakeet : reject invalid n_dims in tensor header to prevent stack-buffer-overflow on malformed model files (#3957)

* fix: reject invalid n_dims in    tensor header to prevent stack-buffer-overflow on malformed model files

* Validate n_dims value in model file loading

Add error handling for invalid n_dims in model file.
---

diff --git a/src/parakeet.cpp b/src/parakeet.cpp
index 178f049b..59ad5c73 100644
--- a/src/parakeet.cpp
+++ b/src/parakeet.cpp
@@ -1439,6 +1439,11 @@ static bool parakeet_model_load(struct parakeet_model_loader * loader, parakeet_
                 break;
             }
 
+            if (n_dims < 0 || n_dims > 4) {
+                  PARAKEET_LOG_ERROR("%s: invalid n_dims %d in model file (expected 0 <= n_dims <= 4)\n", __func__, n_dims);
+                  return false;
+            }
+
             int32_t nelements = 1;
             int32_t ne[4] = { 1, 1, 1, 1 };
             for (int i = 0; i < n_dims; ++i) {
diff --git a/src/whisper.cpp b/src/whisper.cpp
index 2a95bdb1..4ac3b110 100644
--- a/src/whisper.cpp
+++ b/src/whisper.cpp
@@ -1879,6 +1879,12 @@ static bool whisper_model_load(struct whisper_model_loader * loader, whisper_con
                 break;
             }
 
+             if (n_dims < 0 || n_dims > 4) {
+                  WHISPER_LOG_ERROR("%s: invalid n_dims %d in model file (expected 0 <= n_dims <= 4)\n", __func__, n_dims);
+                  return false;
+              }
+
+
             int32_t nelements = 1;
             int32_t ne[4] = { 1, 1, 1, 1 };
             for (int i = 0; i < n_dims; ++i) {
@@ -5021,6 +5027,12 @@ struct whisper_vad_context * whisper_vad_init_with_params(
                 break;
             }
 
+            if (n_dims < 0 || n_dims > 4) {
+                  WHISPER_LOG_ERROR("%s: invalid n_dims %d in model file (expected 0 <= n_dims <= 4)\n", __func__, n_dims);
+                  return nullptr;
+            }
+
+
             int32_t nelements = 1;
             int32_t ne[4] = { 1, 1, 1, 1 };
             for (int i = 0; i < n_dims; ++i) {