Security context

Highlights

Heap-based Buffer Overflow: 1 prior fix. Scrutinize any change in this area.

sherpa-onnx/csrc/offline-tts.cc: most-fixed (1 issue). Treat as high-risk during review.

1 high-severity fix in this history; regressions here are high-impact.

Recurring patterns

Out-of-bounds Read / Denial of Service: ScaleSilence copies sample ranges into an output vector using an interval start and length derived from silence scaling; when scale > 1, the computed end can exceed the source buffer, causing an over-read and crash. The fix adds a bounds check and zero-padding, but similar interval-copy logic may exist in other TTS or audio-processing paths.

Heap-based Buffer Overflow: ReadWaveImpl reads a subchunk2 size from the WAV header; when the size is odd, the read length can exceed the allocated buffer capacity, leading to a heap overflow. The fix adds a buffer-size check before the read. This indicates insufficient validation of header-derived lengths before direct stream reads.