Skip to content

Commit 61099f8

Browse files
committed
vad : fix buffer overflow in sample reduction loop
The buffer size calculation loop (line ~6661) uses `n_samples - 1` as the upper bound for segment_end_samples, but the copy loop (line 6696) uses `n_samples`. This inconsistency allows the copy loop to compute segment_length values up to 1 sample larger per segment than what was allocated, causing heap corruption. Symptom: `malloc(): corrupted top size` or `malloc(): invalid size (unsorted)` crashes after VAD completes sample reduction. Fix: Use consistent bounds (`n_samples - 1`) in both loops. Fixes #3403
1 parent 19ceec8 commit 61099f8

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

src/whisper.cpp

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6693,7 +6693,7 @@ static bool whisper_vad(
66936693
}
66946694

66956695
segment_start_samples = std::min(segment_start_samples, n_samples - 1);
6696-
segment_end_samples = std::min(segment_end_samples, n_samples);
6696+
segment_end_samples = std::min(segment_end_samples, n_samples - 1);
66976697
int segment_length = segment_end_samples - segment_start_samples;
66986698
if (segment_length > 0) {
66996699
whisper_state::vad_segment_info segment;

0 commit comments

Comments
 (0)