Fix use-after-free by making GeneratorParams co-own its Model

[jiafatom]

Summary

Fixes a use-after-free (CWE-416) reachable through the public C ABI.

GeneratorParams stored only a bare const Config& aliasing the model-owned Config (src/generators.h), relying on the documented-but-unenforced assumption that "the model outlives the GeneratorParams". It did not take co-ownership of the model. The following ordinary C API sequence therefore triggers a UAF:

1. OgaCreateModel — allocates the Model and its std::unique_ptr<Config> config_.
2. OgaCreateGeneratorParams — binds config{*model.config_.get()}, a bare reference; the model's refcount is unchanged.
3. OgaDestroyModel — ExternalRelease drops the last owner and frees the Model and its Config.
4. OgaCreateGenerator(model, params) — Generator::Generator runs model_{model.shared_from_this()} on the freed model → heap-use-after-free read.

Generator already co-owns the model via std::shared_ptr<const Model> model_; GeneratorParams did not follow the same discipline, leaving the window open.

Fix

• src/generators.h: add std::shared_ptr<const Model> model_owner_ to GeneratorParams, declared before the config reference so it is initialized first.
• src/generators.cpp: initialize model_owner_{model.shared_from_this()} and bind config{*model_owner_->config_.get()}. Now the model (and its Config) cannot be freed while a params handle is live, and a generator can never be constructed from a freed model. The benchmark-only GeneratorParams(const Config&) path leaves model_owner_ null by design.
• test/c_api_tests.cpp: add CreateGeneratorAfterDestroyModel, reproducing the PoC ordering (destroy model handle, then create generator) and asserting success without a UAF.

Testing

Local build isn't available in my environment (root-owned build dir / needs the jiafa-dev container); relying on CI to build and run the C++ unit tests, ideally under ASan.

[Copilot]

Pull request overview

This PR fixes a use-after-free in the public C API by ensuring GeneratorParams co-owns the Model it was created from, preventing the model-owned Config from being freed while params are still alive.

Changes:

• Add std::shared_ptr<const Model> model_owner_ to GeneratorParams to extend model lifetime.
• Initialize model_owner_ via model.shared_from_this() and bind config through model_owner_.
• Add a C API regression test covering the destroy-model-then-create-generator sequence.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
test/c_api_tests.cpp	Adds regression coverage for the C API lifetime/UAF scenario.
src/generators.h	Extends GeneratorParams to co-own the model backing its aliased Config.
src/generators.cpp	Initializes model_owner_ and binds config through it to prevent UAF.