Skip to content

Fix 32-bit loop index overflow in forced_align CPU init loops#4209

Open
happyarts wants to merge 1 commit into
pytorch:mainfrom
happyarts:fix/forced-align-init-loop-overflow
Open

Fix 32-bit loop index overflow in forced_align CPU init loops#4209
happyarts wants to merge 1 commit into
pytorch:mainfrom
happyarts:fix/forced-align-init-loop-overflow

Conversation

@happyarts

Copy link
Copy Markdown

Fixes #4208

Summary

forced_align (CPU) segfaults when frames * (2 * target_length + 1) exceeds 2^31. The backPtr_a init loop in forced_align_impl uses an int index against an int64_t trip count:

auto backPtr_a = new int8_t[T * S];     // T, S are int64_t -- allocation is fine
for (int i = 0; i < T * S; i++) {       // int i overflows at 2^31 (UB)
  backPtr_a[i] = -1;
}

Once i wraps, the store lands at backPtr_a - 2^31 bytes → SIGSEGV. This is reachable with realistic inputs (character-level CTC alignment of ~20 minutes of dense speech at 50 fps), and int64 targets crash identically since the dispatch only changes target_t. Full analysis incl. a crash report whose fault address is exactly buffer_base - 0x80000000 in #4208.

This PR makes both init loop indices int64_t (the alphas_a loop two lines above uses the same idiom; not practically reachable today, changed for consistency). All other indexing in the kernel already promotes to int64_t because S is int64_t.

Verification

Built from this branch (c0cbdb9 + this patch) against torch 2.13.0, macOS arm64 (M1 Max):

Case before (2.11.0 wheel) after (patched build)
T=70 000, L=15 500 (2.17e9 cells), int32 targets 💥 SIGSEGV ✅ correct, ~8 s
same, int64 targets 💥 SIGSEGV ✅ identical scores to int32
43 recorded small/medium cases (random emissions, heavy repeats, tight T == L+R fits, single-token targets) reference (recorded on 2.8.0/2.11.0) ✅ bit-identical paths & scores

Repro script in #4208 (needs ~2.2 GB RAM; crashes the interpreter without this patch).

The backPtr_a init loop in forced_align_impl uses an int index against an
int64_t trip count (T * S). Once T * (2*L+1) exceeds 2^31 the index
overflows (UB), the store lands at backPtr_a - 2^31 bytes, and the process
dies with SIGSEGV. Reachable with realistic inputs: character-level CTC
alignment of ~20 minutes of dense speech at 50 fps crosses the limit.
int64 targets crash identically (dispatch only changes target_t).

Make both init loop indices int64_t (the alphas_a loop uses the same
idiom; not practically reachable, fixed for consistency).

Verified on macOS arm64 (M1 Max) against torch 2.13:
- T=70000, L=15500 (2.17e9 cells): SIGSEGV before, correct result in ~8 s
  after, with int32 and int64 targets producing identical scores
- 43 recorded small/medium alignment cases remain bit-identical

Fixes pytorch#4208
@happyarts
happyarts requested a review from a team as a code owner July 22, 2026 13:23
@pytorch-bot

pytorch-bot Bot commented Jul 22, 2026

Copy link
Copy Markdown

🔗 Helpful Links

🧪 See artifacts and rendered test results at hud.pytorch.org/pr/pytorch/audio/4209

Note: Links to docs will display an error until the docs builds have been completed.

❗ 1 Active SEVs

There are 1 currently active SEVs. If your PR is affected, please view them below:

This comment was automatically generated by Dr. CI and updates every 15 minutes.

@meta-cla

meta-cla Bot commented Jul 22, 2026

Copy link
Copy Markdown

Hi @happyarts!

Thank you for your pull request and welcome to our community.

Action Required

In order to merge any pull request (code, docs, etc.), we require contributors to sign our Contributor License Agreement, and we don't seem to have one on file for you.

Process

In order for us to review and merge your suggested changes, please sign at https://code.facebook.com/cla. If you are contributing on behalf of someone else (eg your employer), the individual CLA may not be sufficient and your employer may need to sign the corporate CLA.

Once the CLA is signed, our tooling will perform checks and validations. Afterwards, the pull request will be tagged with CLA signed. The tagging process may take up to 1 hour after signing. Please give it that time before contacting us about it.

If you have received this in error or have any questions, please contact us at [email protected]. Thanks!

@meta-cla

meta-cla Bot commented Jul 22, 2026

Copy link
Copy Markdown

Thank you for signing our Contributor License Agreement. We can now accept your code for this (and any) Meta Open Source project. Thanks!

@meta-cla meta-cla Bot added the CLA Signed label Jul 22, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

forced_align (CPU) segfaults when frames * (2*targets+1) exceeds 2^31: 32-bit loop index overflow

1 participant