Skip to content

Conversation

@josephsellers
Copy link
Contributor

Summary

Fix heap corruption crash in VAD processing caused by buffer overflow in the sample reduction loop.

Problem

The buffer size calculation loop (line ~6661) uses n_samples - 1 as the upper bound:

segment_end_samples = std::min(segment_end_samples, n_samples - 1);
filtered_n_samples  += (segment_end_samples - segment_start_samples);

But the copy loop (line 6696) uses n_samples:

segment_end_samples = std::min(segment_end_samples, n_samples);  // BUG: inconsistent bound
int segment_length = segment_end_samples - segment_start_samples;

This allows segment_length to be up to 1 sample larger per segment than what was allocated, causing writes past the end of filtered_samples buffer.

Symptom

  • malloc(): corrupted top size
  • malloc(): invalid size (unsorted)
  • Crashes after VAD completes: whisper_vad: Reduced audio from X to Y samples
  • Intermittent (depends on heap layout)

Fix

Use consistent bounds (n_samples - 1) in both loops.

Fixes #3403

The buffer size calculation loop (line ~6661) uses `n_samples - 1` as
the upper bound for segment_end_samples, but the copy loop (line 6696)
uses `n_samples`. This inconsistency allows the copy loop to compute
segment_length values up to 1 sample larger per segment than what was
allocated, causing heap corruption.

Symptom: `malloc(): corrupted top size` or `malloc(): invalid size
(unsorted)` crashes after VAD completes sample reduction.

Fix: Use consistent bounds (`n_samples - 1`) in both loops.

Fixes ggml-org#3403
@danbev danbev merged commit a88b93f into ggml-org:master Dec 6, 2025
62 of 66 checks passed
@danbev
Copy link
Member

danbev commented Dec 6, 2025

@josephsellers Thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

VAD coredump (whisper-server)

2 participants