From 6de62b7af2540595092cde186ee82a574a45f9c2 Mon Sep 17 00:00:00 2001 From: contra Date: Fri, 6 Mar 2026 08:21:00 -0800 Subject: [PATCH] fix: off-by-one in Kokoro::synthesize voice index causes crash MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `voice_` is `std::array<..., kMaxInputTokens>` (128 elements, valid indices 0–127). When `noTokens` equals `kMaxInputTokens` (128) and `phonemes.size() - 1 >= 128`, `voiceID` becomes 128 — one past the end — triggering an out-of-bounds access and aborting on the `RN_ET_Worker0` thread. Fix: cap `voiceID` at `noTokens - 1` instead of `noTokens`. --- .../common/rnexecutorch/models/text_to_speech/kokoro/Kokoro.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/react-native-executorch/common/rnexecutorch/models/text_to_speech/kokoro/Kokoro.cpp b/packages/react-native-executorch/common/rnexecutorch/models/text_to_speech/kokoro/Kokoro.cpp index d73fb6205..4493ec513 100644 --- a/packages/react-native-executorch/common/rnexecutorch/models/text_to_speech/kokoro/Kokoro.cpp +++ b/packages/react-native-executorch/common/rnexecutorch/models/text_to_speech/kokoro/Kokoro.cpp @@ -198,7 +198,7 @@ std::vector Kokoro::synthesize(const std::u32string &phonemes, const auto tokens = utils::tokenize(phonemes, {noTokens}); // Select the appropriate voice vector - size_t voiceID = std::min(phonemes.size() - 1, noTokens); + size_t voiceID = std::min(phonemes.size() - 1, noTokens - 1); auto &voice = voice_[voiceID]; // Initialize text mask