Fix 32-bit loop index overflow in forced_align CPU init loops#4209
Fix 32-bit loop index overflow in forced_align CPU init loops#4209happyarts wants to merge 1 commit into
Conversation
The backPtr_a init loop in forced_align_impl uses an int index against an int64_t trip count (T * S). Once T * (2*L+1) exceeds 2^31 the index overflows (UB), the store lands at backPtr_a - 2^31 bytes, and the process dies with SIGSEGV. Reachable with realistic inputs: character-level CTC alignment of ~20 minutes of dense speech at 50 fps crosses the limit. int64 targets crash identically (dispatch only changes target_t). Make both init loop indices int64_t (the alphas_a loop uses the same idiom; not practically reachable, fixed for consistency). Verified on macOS arm64 (M1 Max) against torch 2.13: - T=70000, L=15500 (2.17e9 cells): SIGSEGV before, correct result in ~8 s after, with int32 and int64 targets producing identical scores - 43 recorded small/medium alignment cases remain bit-identical Fixes pytorch#4208
🔗 Helpful Links🧪 See artifacts and rendered test results at hud.pytorch.org/pr/pytorch/audio/4209
Note: Links to docs will display an error until the docs builds have been completed. ❗ 1 Active SEVsThere are 1 currently active SEVs. If your PR is affected, please view them below: This comment was automatically generated by Dr. CI and updates every 15 minutes. |
|
Hi @happyarts! Thank you for your pull request and welcome to our community. Action RequiredIn order to merge any pull request (code, docs, etc.), we require contributors to sign our Contributor License Agreement, and we don't seem to have one on file for you. ProcessIn order for us to review and merge your suggested changes, please sign at https://code.facebook.com/cla. If you are contributing on behalf of someone else (eg your employer), the individual CLA may not be sufficient and your employer may need to sign the corporate CLA. Once the CLA is signed, our tooling will perform checks and validations. Afterwards, the pull request will be tagged with If you have received this in error or have any questions, please contact us at [email protected]. Thanks! |
|
Thank you for signing our Contributor License Agreement. We can now accept your code for this (and any) Meta Open Source project. Thanks! |
Fixes #4208
Summary
forced_align(CPU) segfaults whenframes * (2 * target_length + 1)exceeds 2^31. ThebackPtr_ainit loop inforced_align_impluses anintindex against anint64_ttrip count:Once
iwraps, the store lands atbackPtr_a - 2^31bytes → SIGSEGV. This is reachable with realistic inputs (character-level CTC alignment of ~20 minutes of dense speech at 50 fps), and int64 targets crash identically since the dispatch only changestarget_t. Full analysis incl. a crash report whose fault address is exactlybuffer_base - 0x80000000in #4208.This PR makes both init loop indices
int64_t(thealphas_aloop two lines above uses the same idiom; not practically reachable today, changed for consistency). All other indexing in the kernel already promotes toint64_tbecauseSisint64_t.Verification
Built from this branch (c0cbdb9 + this patch) against torch 2.13.0, macOS arm64 (M1 Max):
T == L+Rfits, single-token targets)Repro script in #4208 (needs ~2.2 GB RAM; crashes the interpreter without this patch).