onnxruntime WhisperBeamSearch decoder — heap out-of-bounds write PoC
Responsible-disclosure proof-of-concept for a huntr report.
whisper_seqcopy_symbolic.onnx triggers a heap out-of-bounds write in onnxruntime's
com.microsoft.WhisperBeamSearch decoder — a byte-count vs element-count confusion in the
sequence-copy path of WhisperDecoderSubgraph::CreateInitialFeeds — when the model is run with
InferenceSession.Run(). A negative-control model (whisper_seqcopy_fixed1.onnx) runs clean.
See REPRO.md for the AddressSanitizer reproduction steps. Not for malicious use.
