Summary
whisper_model_load() in whisper.cpp:1678 constructs a std::string from an invalid pointer read from untrusted model file data, causing std::__throw_logic_error → std::terminate() → SIGABRT.
Version
whisper.cpp v1.8.3 & v1.7.5
Reproducer
An 8-byte malformed model file triggers the crash. Found via AFL++ fuzzing.
The input causes the model loader to read a bogus pointer value (e.g. 0x7e8) from the model data and pass it directly to the std::string constructor, which aborts.
Stack Trace
#0 __pthread_kill_implementation at ./nptl/pthread_kill.c:44
#1 __pthread_kill_internal at ./nptl/pthread_kill.c:78
#2 __GI___pthread_kill at ./nptl/pthread_kill.c:89
#3 __GI_raise (sig=6) at ../sysdeps/posix/raise.c:26
#4 __GI_abort () at ./stdlib/abort.c:79
#5 ?? () from libstdc++.so.6
#6 ?? () from libstdc++.so.6
#7 std::terminate() () from libstdc++.so.6
#8 __cxa_throw () from libstdc++.so.6
#9 std::__throw_logic_error(char const*) () from libstdc++.so.6
#10 std::__cxx11::basic_string<...>::basic_string<...> (__s=0x7e8 <error: Cannot access memory at address 0x7e8>) at basic_string.h:646
#11 whisper_model_load at whisper.cpp:1678
#12 whisper_init_with_params_no_state at whisper.cpp:3734
#13 whisper_init_from_file_with_params_no_state at whisper.cpp:3670
#14 whisper_init_from_file_with_params at whisper.cpp:3747
Expected Behavior
The model loader should validate pointer/offset values read from the model file before using them to construct strings. Malformed model files should be rejected gracefully rather than causing an abort.
Summary
whisper_model_load() in whisper.cpp:1678 constructs a std::string from an invalid pointer read from untrusted model file data, causing std::__throw_logic_error → std::terminate() → SIGABRT.
Version
whisper.cpp v1.8.3 & v1.7.5
Reproducer
An 8-byte malformed model file triggers the crash. Found via AFL++ fuzzing.
The input causes the model loader to read a bogus pointer value (e.g. 0x7e8) from the model data and pass it directly to the std::string constructor, which aborts.
Stack Trace
#0 __pthread_kill_implementation at ./nptl/pthread_kill.c:44
#1 __pthread_kill_internal at ./nptl/pthread_kill.c:78
#2 __GI___pthread_kill at ./nptl/pthread_kill.c:89
#3 __GI_raise (sig=6) at ../sysdeps/posix/raise.c:26
#4 __GI_abort () at ./stdlib/abort.c:79
#5 ?? () from libstdc++.so.6
#6 ?? () from libstdc++.so.6
#7 std::terminate() () from libstdc++.so.6
#8 __cxa_throw () from libstdc++.so.6
#9 std::__throw_logic_error(char const*) () from libstdc++.so.6
#10 std::__cxx11::basic_string<...>::basic_string<...> (__s=0x7e8 <error: Cannot access memory at address 0x7e8>) at basic_string.h:646
#11 whisper_model_load at whisper.cpp:1678
#12 whisper_init_with_params_no_state at whisper.cpp:3734
#13 whisper_init_from_file_with_params_no_state at whisper.cpp:3670
#14 whisper_init_from_file_with_params at whisper.cpp:3747
Expected Behavior
The model loader should validate pointer/offset values read from the model file before using them to construct strings. Malformed model files should be rejected gracefully rather than causing an abort.