fix(ios): Add SAFE_SHERPA_ONNX_OR macro to prevent FFI invalid pointe… #2682
+29
−25
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…r crashes on iOS - Adds pointer validation before dereferencing in GetOfflineTtsConfig - Checks for null and low-address invalid pointers (<0x1000) - Applies to all string fields in TTS model configs (vits, matcha, kokoro, kitten) - Fixes crashes on iOS when Flutter FFI passes uninitialized pointers - Based on v1.12.14 for compatibility with Flutter sherpa_onnx plugin
dosubot
bot
added
the
size:M
WalkthroughAdds a pointer-safety macro (SAFE_SHERPA_ONNX_OR) and replaces prior SHERPA_ONNX_OR usages across offline TTS config parsing in c-api.cc to validate FFI-provided pointers before assignment, defaulting to provided fallback values when invalid. No public API changes. Changes
Sequence Diagram(s)sequenceDiagram
autonumber
actor Caller as FFI Caller
participant CAPI as c-api.cc
participant Config as TTS Config
Caller->>CAPI: Provide raw char* fields
rect rgba(230,245,255,0.6)
note right of CAPI: SAFE_SHERPA_ONNX_OR<br/>Validate pointer (!= null, addr > 0x1000)
alt Pointer valid
CAPI->>Config: Assign provided value
else Pointer invalid
CAPI->>Config: Assign default (e.g., "cpu", "")
end
end
CAPI-->>Caller: Return configured object
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Poem
Pre-merge checks and finishing touches❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✨ Finishing touches
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Comment on lines
+1169
to
+1171
| // iOS安全指针检查宏：防止FFI传递的无效指针导致崩溃 | ||
| // 检查指针是否为null或指向低地址区域（通常是无效指针） | ||
| #define SAFE_SHERPA_ONNX_OR(x, y) ((x && (uintptr_t)(x) >= 0x1000) ? x : y) |
There was a problem hiding this comment.
🛠️ Refactor suggestion | 🟠 Major
🧩 Analysis chain
Address the comment language and consider logging invalid pointers.
The macro implementation has several concerns:
- Comment language: The Chinese comment should be translated to English for consistency with the rest of the codebase.
- Threshold portability: The
0x1000threshold is a heuristic that may not be reliable across all platforms or memory configurations. While common for detecting null-like low addresses, it's not guaranteed to catch all invalid pointers. - Silent failures: When an invalid pointer is detected, the macro silently falls back to the default value without logging. This makes debugging difficult and hides the underlying issue.
- Root cause: This appears to be a workaround for Flutter FFI passing uninitialized pointers. Consider whether the FFI boundary should validate pointers before calling into native code.
Apply this diff to improve the implementation:
-// iOS安全指针检查宏：防止FFI传递的无效指针导致崩溃
-// 检查指针是否为null或指向低地址区域（通常是无效指针）
+// Safety macro for iOS: Prevents crashes from invalid pointers passed via FFI
+// Checks if pointer is null or points to low-address region (typically invalid pointers)
+// Note: 0x1000 threshold is a heuristic and may not catch all invalid pointers
-#define SAFE_SHERPA_ONNX_OR(x, y) ((x && (uintptr_t)(x) >= 0x1000) ? x : y)
+#define SAFE_SHERPA_ONNX_OR(x, y) \
+ (((x) && (uintptr_t)(x) >= 0x1000) ? (x) : \
+ (SHERPA_ONNX_LOGE("Invalid pointer detected at %s:%d, using fallback", __FILE__, __LINE__), (y)))Additionally, consider whether this should be conditionally compiled for iOS only:
+#ifdef __APPLE__
#define SAFE_SHERPA_ONNX_OR(x, y) ((x && (uintptr_t)(x) >= 0x1000) ? x : y)
+#else
+#define SAFE_SHERPA_ONNX_OR(x, y) SHERPA_ONNX_OR(x, y)
+#endif🏁 Script executed:
#!/bin/bash
# Find macro definition and its comment
rg -n "SAFE_SHERPA_ONNX_OR" -C2 sherpa-onnx/c-api/c-api.cc
# Check other uses of the original macro
rg -n "SHERPA_ONNX_OR" -C2 sherpa-onnx/c-api/c-api.cc
# Inspect GetOfflineTtsConfig to see scope of SAFE_SHERPA_ONNX_OR usage
rg -n "GetOfflineTtsConfig" -C5 sherpa-onnx/c-api/c-api.ccLength of output: 28746
Improve SAFE_SHERPA_ONNX_OR macro robustness
- Translate the Chinese comments at lines 1169–1170 into English for consistency.
- Enhance the macro (line 1171) to log when an invalid pointer is detected instead of silently falling back.
- Guard the low-address heuristic (0x1000) behind an iOS-specific
#ifdef __APPLE__or clearly document its platform limitations. - Consider validating FFI pointers at the boundary rather than masking the root cause here.
Comment on lines
+1178
to
+1248
| tts_config.model.vits.model = SAFE_SHERPA_ONNX_OR(config->model.vits.model, ""); | ||
| tts_config.model.vits.lexicon = | ||
| SHERPA_ONNX_OR(config->model.vits.lexicon, ""); | ||
| tts_config.model.vits.tokens = SHERPA_ONNX_OR(config->model.vits.tokens, ""); | ||
| SAFE_SHERPA_ONNX_OR(config->model.vits.lexicon, ""); | ||
| tts_config.model.vits.tokens = SAFE_SHERPA_ONNX_OR(config->model.vits.tokens, ""); | ||
| tts_config.model.vits.data_dir = | ||
| SHERPA_ONNX_OR(config->model.vits.data_dir, ""); | ||
| SAFE_SHERPA_ONNX_OR(config->model.vits.data_dir, ""); | ||
| tts_config.model.vits.noise_scale = | ||
| SHERPA_ONNX_OR(config->model.vits.noise_scale, 0.667); | ||
| tts_config.model.vits.noise_scale_w = | ||
| SHERPA_ONNX_OR(config->model.vits.noise_scale_w, 0.8); | ||
| tts_config.model.vits.length_scale = | ||
| SHERPA_ONNX_OR(config->model.vits.length_scale, 1.0); | ||
| tts_config.model.vits.dict_dir = | ||
| SHERPA_ONNX_OR(config->model.vits.dict_dir, ""); | ||
| SAFE_SHERPA_ONNX_OR(config->model.vits.dict_dir, ""); | ||
|
|
||
| // matcha | ||
| tts_config.model.matcha.acoustic_model = | ||
| SHERPA_ONNX_OR(config->model.matcha.acoustic_model, ""); | ||
| SAFE_SHERPA_ONNX_OR(config->model.matcha.acoustic_model, ""); | ||
| tts_config.model.matcha.vocoder = | ||
| SHERPA_ONNX_OR(config->model.matcha.vocoder, ""); | ||
| SAFE_SHERPA_ONNX_OR(config->model.matcha.vocoder, ""); | ||
| tts_config.model.matcha.lexicon = | ||
| SHERPA_ONNX_OR(config->model.matcha.lexicon, ""); | ||
| SAFE_SHERPA_ONNX_OR(config->model.matcha.lexicon, ""); | ||
| tts_config.model.matcha.tokens = | ||
| SHERPA_ONNX_OR(config->model.matcha.tokens, ""); | ||
| SAFE_SHERPA_ONNX_OR(config->model.matcha.tokens, ""); | ||
| tts_config.model.matcha.data_dir = | ||
| SHERPA_ONNX_OR(config->model.matcha.data_dir, ""); | ||
| SAFE_SHERPA_ONNX_OR(config->model.matcha.data_dir, ""); | ||
| tts_config.model.matcha.noise_scale = | ||
| SHERPA_ONNX_OR(config->model.matcha.noise_scale, 0.667); | ||
| tts_config.model.matcha.length_scale = | ||
| SHERPA_ONNX_OR(config->model.matcha.length_scale, 1.0); | ||
| tts_config.model.matcha.dict_dir = | ||
| SHERPA_ONNX_OR(config->model.matcha.dict_dir, ""); | ||
| SAFE_SHERPA_ONNX_OR(config->model.matcha.dict_dir, ""); | ||
|
|
||
| // kokoro | ||
| tts_config.model.kokoro.model = | ||
| SHERPA_ONNX_OR(config->model.kokoro.model, ""); | ||
| SAFE_SHERPA_ONNX_OR(config->model.kokoro.model, ""); | ||
| tts_config.model.kokoro.voices = | ||
| SHERPA_ONNX_OR(config->model.kokoro.voices, ""); | ||
| SAFE_SHERPA_ONNX_OR(config->model.kokoro.voices, ""); | ||
| tts_config.model.kokoro.tokens = | ||
| SHERPA_ONNX_OR(config->model.kokoro.tokens, ""); | ||
| SAFE_SHERPA_ONNX_OR(config->model.kokoro.tokens, ""); | ||
| tts_config.model.kokoro.data_dir = | ||
| SHERPA_ONNX_OR(config->model.kokoro.data_dir, ""); | ||
| SAFE_SHERPA_ONNX_OR(config->model.kokoro.data_dir, ""); | ||
| tts_config.model.kokoro.length_scale = | ||
| SHERPA_ONNX_OR(config->model.kokoro.length_scale, 1.0); | ||
| tts_config.model.kokoro.dict_dir = | ||
| SHERPA_ONNX_OR(config->model.kokoro.dict_dir, ""); | ||
| SAFE_SHERPA_ONNX_OR(config->model.kokoro.dict_dir, ""); | ||
| tts_config.model.kokoro.lexicon = | ||
| SHERPA_ONNX_OR(config->model.kokoro.lexicon, ""); | ||
| tts_config.model.kokoro.lang = SHERPA_ONNX_OR(config->model.kokoro.lang, ""); | ||
| SAFE_SHERPA_ONNX_OR(config->model.kokoro.lexicon, ""); | ||
| tts_config.model.kokoro.lang = SAFE_SHERPA_ONNX_OR(config->model.kokoro.lang, ""); | ||
|
|
||
| // kitten | ||
| tts_config.model.kitten.model = | ||
| SHERPA_ONNX_OR(config->model.kitten.model, ""); | ||
| SAFE_SHERPA_ONNX_OR(config->model.kitten.model, ""); | ||
| tts_config.model.kitten.voices = | ||
| SHERPA_ONNX_OR(config->model.kitten.voices, ""); | ||
| SAFE_SHERPA_ONNX_OR(config->model.kitten.voices, ""); | ||
| tts_config.model.kitten.tokens = | ||
| SHERPA_ONNX_OR(config->model.kitten.tokens, ""); | ||
| SAFE_SHERPA_ONNX_OR(config->model.kitten.tokens, ""); | ||
| tts_config.model.kitten.data_dir = | ||
| SHERPA_ONNX_OR(config->model.kitten.data_dir, ""); | ||
| SAFE_SHERPA_ONNX_OR(config->model.kitten.data_dir, ""); | ||
| tts_config.model.kitten.length_scale = | ||
| SHERPA_ONNX_OR(config->model.kitten.length_scale, 1.0); | ||
|
|
||
| tts_config.model.num_threads = SHERPA_ONNX_OR(config->model.num_threads, 1); | ||
| tts_config.model.debug = config->model.debug; | ||
| tts_config.model.provider = SHERPA_ONNX_OR(config->model.provider, "cpu"); | ||
| tts_config.model.provider = SAFE_SHERPA_ONNX_OR(config->model.provider, "cpu"); | ||
| if (tts_config.model.provider.empty()) { | ||
| tts_config.model.provider = "cpu"; | ||
| } | ||
|
|
||
| tts_config.rule_fsts = SHERPA_ONNX_OR(config->rule_fsts, ""); | ||
| tts_config.rule_fars = SHERPA_ONNX_OR(config->rule_fars, ""); | ||
| tts_config.rule_fsts = SAFE_SHERPA_ONNX_OR(config->rule_fsts, ""); | ||
| tts_config.rule_fars = SAFE_SHERPA_ONNX_OR(config->rule_fars, ""); |
There was a problem hiding this comment.
🛠️ Refactor suggestion | 🟠 Major
🧩 Analysis chain
Verify that other config functions don't have the same vulnerability.
The SAFE_SHERPA_ONNX_OR macro is only applied to string fields in GetOfflineTtsConfig, but similar string pointer handling exists in other functions like GetOnlineRecognizerConfig, GetOfflineRecognizerConfig, GetKeywordSpotterConfig, etc. If Flutter FFI can pass invalid pointers to TTS config, it could potentially do the same for other configs.
Run the following script to identify other locations that may need similar protection:
Based on the results, consider either:
- Applying the same protection to other config functions, or
- Documenting why TTS config specifically requires this protection while others don't.
🏁 Script executed:
#!/bin/bash
# Description: Find all usages of SHERPA_ONNX_OR with string/pointer parameters in config functions
# Search for SHERPA_ONNX_OR calls with string-like parameters
rg -n 'SHERPA_ONNX_OR\(config->[^,]+\.(model|lexicon|tokens|data_dir|dict_dir|provider|encoder|decoder|vocoder|voices|lang|graph|rule_fsts|rule_fars|hotwords_file)[^)]*\)' --type cpp -C 2
echo "---"
echo "Summary: Review the above usages to determine if they should also use SAFE_SHERPA_ONNX_OR"Length of output: 23186
Wrap all string‐pointer config fields with SAFE_SHERPA_ONNX_OR
Several config getters (recognizer, spotter, VAD, SLID, audio tagging, denoiser, punctuation, segmentation, embedding, etc.) currently use SHERPA_ONNX_OR directly on string/pointer fields (model, encoder, decoder, tokens, lexicon, etc.). Replace these with SAFE_SHERPA_ONNX_OR to guard against invalid pointers over FFI.
🤖 Prompt for AI Agents
In sherpa-onnx/c-api/c-api.cc around lines 1178 to 1248, several config getters
use SHERPA_ONNX_OR directly on string/pointer fields which risks dereferencing
invalid FFI pointers; replace usages of SHERPA_ONNX_OR for any string or char*
fields (model, encoder, decoder, tokens, lexicon, voices, data_dir, dict_dir,
lang, etc.) with SAFE_SHERPA_ONNX_OR so they default to an empty string when the
pointer is invalid; leave numeric or boolean fields (noise_scale, length_scale,
num_threads, debug, etc.) using SHERPA_ONNX_OR as before and ensure resulting
tts_config fields are assigned the SAFE_* results.
csukuangfj
reviewed
Oct 14, 2025
| std::unique_ptr<sherpa_onnx::OfflineTts> impl; | ||
| }; | ||
|
|
||
| // iOS安全指针检查宏：防止FFI传递的无效指针导致崩溃 |
There was a problem hiding this comment.
请问这个无效指针是哪里来的？
如果不为空，为什么还要额外判断？
There was a problem hiding this comment.
这个是模型总结的问题，当然对我来说超纲了。
我对比两个版本APP是这样，修复后可以用，不修复的版本英文模型报错。
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
📋 提交概述
修复目标： 解决 sherpa-onnx v1.12.14 在 iOS 上的 FFI 指针崩溃问题
提交分支：
fix/ios-v1.12.14-safe-pointers基于版本： v1.12.14 (tag: 26aa2fa)
提交 ID： 7af3e5e
🔧 具体修改内容
修改文件
文件路径：
sherpa-onnx/c-api/c-api.cc修改统计：
核心修改
1. 新增安全指针检查宏
位置： 第 1169-1172 行
功能说明：
nullptr0x1000(4096)0x0008）与官方宏的对比：
SHERPA_ONNX_OR(x, y)x != 0SAFE_SHERPA_ONNX_OR(x, y)x != null && x >= 0x10002. 应用到所有字符串字段
修改范围： GetOfflineTtsConfig 函数中的所有字符串参数
vits 模型 (5 个字段)
matcha 模型 (6 个字段)
kokoro 模型 (7 个字段)
kitten 模型 (4 个字段)
全局配置 (3 个字段)
总计修改字段： 25 个字符串字段
✅ 测试验证
测试环境
测试结果
修复前（官方 v1.12.14）
Failed to create offline ttsFailed to create offline tts修复后（v1.12.14 + SAFE_SHERPA_ONNX_OR）
稳定性测试： 每个功能测试 10 次，成功率 100%
🎯 提交信息
Commit 信息
标题：
详细描述：
Pull Request 信息（准备）
PR 标题：
PR 描述模板：
Exception: Failed to create offline tts. Please check your config
当
x = 0x0008时：(x)为真（非零）0x0008strlen(0x0008)→ 崩溃解决方案
添加
SAFE_SHERPA_ONNX_OR宏，验证指针地址范围：改进：
应用范围：
总计： 25 个字符串字段
测试结果
测试环境
修复前
修复后
稳定性： 每个功能测试 10 次，成功率 100%
相关 Issue
修复 iOS TTS FFI 指针崩溃问题
复现项目
完整的复现和测试项目：
详细文档：
兼容性
Checklist
不要使用 master 分支：
影响范围
仅影响 iOS 平台：
Summary by CodeRabbit
Bug Fixes
Refactor