Add check for malformed audio files

src/models/processor.cpp

@@ -58,9 +58,17 @@ std::unique_ptr<Audios> LoadAudiosFromBuffers(std::span<const void*> audio_data,
   if (audio_data.size() != audio_data_sizes.size())
     throw std::runtime_error("Number of audio data buffers does not match the number of audio data sizes");
 
+  // Minimum size to hold a valid audio header (WAV=44 bytes, FLAC=42 bytes, MP3 frame=4 bytes header + data).
+  // Reject trivially malformed buffers that cannot contain valid audio.
+  constexpr size_t kMinAudioBufferSize = 44;
   std::vector<int64_t> sizes;
-  for (size_t i = 0; i < audio_data_sizes.size(); ++i)
+  for (size_t i = 0; i < audio_data_sizes.size(); ++i) {
+    if (audio_data_sizes[i] < kMinAudioBufferSize)
+      throw std::runtime_error("Audio buffer " + std::to_string(i) + " is too small (" +
+                               std::to_string(audio_data_sizes[i]) + " bytes). Minimum size is " +
+                               std::to_string(kMinAudioBufferSize) + " bytes.");
     sizes.push_back(audio_data_sizes[i]);
+  }
 
   ort_extensions::OrtxObjectPtr<OrtxRawAudios> audios;
   CheckResult(OrtxCreateRawAudios(audios.ToBeAssigned(), audio_data.data(), sizes.data(), audio_data.size()));

test/c_api_tests.cpp

@@ -1801,3 +1801,24 @@ TEST(CAPITests, ParakeetTdtTranscribeLong) {
   auto transcription = RunParakeetTdt(PARAKEET_TDT_AUDIO_TEDLIUM);
   EXPECT_FALSE(transcription.empty());
 }
+
+// Regression test for MSRC: malformed audio buffers smaller than the minimum valid
+// audio header size must be rejected with an error, not cause a crash.
+TEST(CAPITests, LoadAudiosFromBuffersRejectsTooSmallBuffer) {
+  // 17 bytes of malformed data that previously triggered a heap-buffer-overflow.
+  const uint8_t crash_data[] = {
+      0xff, 0xff, 0x07, 0xfa, 0xe6, 0xe6, 0xe6, 0xe6,
+      0xe6, 0xe6, 0xe6, 0xe6, 0xe6, 0xe6, 0xe6, 0xe6, 0xe6};
+
+  const void* data_ptr = crash_data;
+  size_t data_size = sizeof(crash_data);
+  OgaAudios* audios = nullptr;
+  OgaResult* result = OgaLoadAudiosFromBuffers(&data_ptr, &data_size, 1, &audios);
+
+  // Should return an error for buffers too small to be valid audio.
+  ASSERT_NE(result, nullptr);
+  EXPECT_NE(std::string(OgaResultGetError(result)).find("too small"), std::string::npos);
+  OgaDestroyResult(result);
+  // audios should not have been created
+  EXPECT_EQ(audios, nullptr);
+}