Skip to content

fix: remove dangling pointer to work_output in CLIPTextModel#111

Merged
leejet merged 1 commit into
leejet:masterfrom
Spadi0:fix/CLIPTextModel-end-work-output
Dec 10, 2023
Merged

fix: remove dangling pointer to work_output in CLIPTextModel#111
leejet merged 1 commit into
leejet:masterfrom
Spadi0:fix/CLIPTextModel-end-work-output

Conversation

@Spadi0

@Spadi0 Spadi0 commented Dec 9, 2023

Copy link
Copy Markdown
Contributor

CLIPTextModel::begin() creates a work_output tensor using the provided work_ctx but CLIPTextModel::end() does not set this value back to NULL, causing the next call to CLIPTextModel::begin() to not allocate a new tensor and use the value from the previous iteration instead, which is now a dangling pointer and thus invalid. This means that attempts to make multiple generation calls (StableDiffusion::txt2img()/StableDiffusion::img2img()) using a single StableDiffusion instance will cause memory corruption and results in a segmentation fault.

This doesn't affect the example "sd" binary as it creates the instance and only performs a single generation call before exiting, and this bug only occurs if a single instance is used for generation twice.

@leejet

leejet commented Dec 10, 2023

Copy link
Copy Markdown
Owner

Thank you for your contribution.

@leejet
leejet merged commit ca33304 into leejet:master Dec 10, 2023
@Spadi0
Spadi0 deleted the fix/CLIPTextModel-end-work-output branch December 10, 2023 02:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants