Skip to content

osce: Clamp pitch embedding index#465

Open
matejsmycka wants to merge 1 commit intoxiph:mainfrom
matejsmycka:fix/osce-pitch-embedding-bounds-check
Open

osce: Clamp pitch embedding index#465
matejsmycka wants to merge 1 commit intoxiph:mainfrom
matejsmycka:fix/osce-pitch-embedding-bounds-check

Conversation

@matejsmycka
Copy link

@matejsmycka matejsmycka commented Mar 22, 2026

Missing bounds clamp on SILK pitch lag before OSCE embedding table lookup causes up to 7936-byte heap OOB read when the model is trained with Python default pitch_max=257 (max lag is 288); fix adds IMIN/IMAX clamping matching FARGAN's existing pattern.

The LACE and NoLACE feature networks access the pitch embedding table
using periods[i_subframe] as a direct index without bounds checking.
SILK's decode_pitch() clamps pitch lags to [min_lag, max_lag] where
max_lag = PE_MAX_LAG_MS * Fs_kHz = 288 at 16kHz. If a model is trained
with pitch_max < 288 (the Python training defaults use pitch_max=257),
pitch lag values in the range [pitch_max+1, 288] would read past the
end of the embedding weight table.

Add IMIN/IMAX clamping to bound the pitch index to [0, *_PITCH_MAX]
before the embedding lookup, consistent with how FARGAN handles pitch
embedding access in fargan.c:53.

The current shipped model (v1.6.1) uses pitch_max=300 which covers the
full SILK pitch range, but the C code should defensively clamp regardless
of model parameters.
@matejsmycka matejsmycka changed the title osce: Clamp pitch embedding index to prevent OOB read osce: Clamp pitch embedding index Mar 22, 2026
@matejsmycka matejsmycka force-pushed the fix/osce-pitch-embedding-bounds-check branch from 031c1e0 to 7269861 Compare March 22, 2026 20:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant