From df155554c777d7b05cdda47c2ff12f1cd22cbd26 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Markus=20K=C3=A4mmerer?= Date: Wed, 22 Jul 2026 15:22:28 +0200 Subject: [PATCH] Fix 32-bit loop index overflow in forced_align CPU init loops The backPtr_a init loop in forced_align_impl uses an int index against an int64_t trip count (T * S). Once T * (2*L+1) exceeds 2^31 the index overflows (UB), the store lands at backPtr_a - 2^31 bytes, and the process dies with SIGSEGV. Reachable with realistic inputs: character-level CTC alignment of ~20 minutes of dense speech at 50 fps crosses the limit. int64 targets crash identically (dispatch only changes target_t). Make both init loop indices int64_t (the alphas_a loop uses the same idiom; not practically reachable, fixed for consistency). Verified on macOS arm64 (M1 Max) against torch 2.13: - T=70000, L=15500 (2.17e9 cells): SIGSEGV before, correct result in ~8 s after, with int32 and int64 targets producing identical scores - 43 recorded small/medium alignment cases remain bit-identical Fixes #4208 --- src/libtorchaudio/forced_align/cpu/compute.cpp | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/libtorchaudio/forced_align/cpu/compute.cpp b/src/libtorchaudio/forced_align/cpu/compute.cpp index c14c919e19..ffcd9d15c9 100644 --- a/src/libtorchaudio/forced_align/cpu/compute.cpp +++ b/src/libtorchaudio/forced_align/cpu/compute.cpp @@ -29,12 +29,12 @@ void forced_align_impl( const auto S = 2 * L + 1; auto alphas_a = new scalar_t[2 * S]; // scalar_t is just logProbs.dtype() - for (int i = 0; i < 2 * S; i++) { + for (int64_t i = 0; i < 2 * S; i++) { alphas_a[i] = kNegInfinity; } auto backPtr_a = new int8_t[T * S]; - for (int i = 0; i < T * S; i++) { + for (int64_t i = 0; i < T * S; i++) { backPtr_a[i] = -1; } auto logProbs_a = torchaudio::accessor(logProbs);