Skip to content

fix: off-by-one in Kokoro::synthesize voice index causes crash#941

Open
yocontra wants to merge 1 commit intosoftware-mansion:mainfrom
yocontra:fix/kokoro-voice-oob
Open

fix: off-by-one in Kokoro::synthesize voice index causes crash#941
yocontra wants to merge 1 commit intosoftware-mansion:mainfrom
yocontra:fix/kokoro-voice-oob

Conversation

@yocontra
Copy link

@yocontra yocontra commented Mar 6, 2026

(Larger fix that includes this here: #943)

Broke this out in case you don't want the other change. If you merge #943 you can close this one.

Kokoro::synthesize computes voiceID as:

size_t voiceID = std::min(phonemes.size() - 1, noTokens);

voice_ is std::array<std::array<float, kVoiceRefSize>, kMaxInputTokens> — 128 elements with valid indices 0–127.

When noTokens equals context_.inputTokensLimit (which can be kMaxInputTokens = 128), and phonemes.size() - 1 >= 128, voiceID becomes 128 — one past the end of the array. This causes an out-of-bounds access that aborts on the RN_ET_Worker0 thread.

Crash stack trace

Thread 14 Crashed:: RN_ET_Worker0
0   libsystem_kernel.dylib    __pthread_kill + 8
1   libsystem_pthread.dylib   pthread_kill + 264
2   libsystem_c.dylib         abort + 100
3   Phasma.debug.dylib        std::array<std::array<float, 256>, 128>::operator[] + 52 (array:269)
4   Phasma.debug.dylib        Kokoro::synthesize(...) + 232 (Kokoro.cpp:202)
5   Phasma.debug.dylib        Kokoro::generate(...) + 448 (Kokoro.cpp:94)

Fix

Cap voiceID at noTokens - 1 instead of noTokens:

size_t voiceID = std::min(phonemes.size() - 1, noTokens - 1);

This keeps the index within the valid range of voice_.

`voice_` is `std::array<..., kMaxInputTokens>` (128 elements, valid
indices 0–127). When `noTokens` equals `kMaxInputTokens` (128) and
`phonemes.size() - 1 >= 128`, `voiceID` becomes 128 — one past the
end — triggering an out-of-bounds access and aborting on the
`RN_ET_Worker0` thread.

Fix: cap `voiceID` at `noTokens - 1` instead of `noTokens`.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug fix PRs that are fixing bugs

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants