Skip to content

Remove stale GenAI LSan suppressions and fix tool-call parsing UAF #1323

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
bmehta001 wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Remove stale GenAI LSan suppressions and fix tool-call parsing UAF #1323

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
35e430e
Fix dangling structured binding in singleton tool-call parsing
bmehta001 Nov 11, 2026
219cbd4
Remove LSan suppressions fixed in ONNX Runtime GenAI
bmehta001 Nov 11, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 3 additions & 2 deletions sdk_v2/cpp/src/inferencing/generative/toolcalling/tool_call_utils.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -535,8 +535,9 @@ std::vector<ParsedToolCall> DeserializeToolCalls(const std::string& json_text,
} else if (call.size() == 1 && !call.contains("name") &&
!call.contains("function") && !call.contains("arguments") &&
!call.contains("parameters") && !call.contains("args")) {
const auto& [name, arguments] = *call.items().begin();
tc.name = CleanToolName(name);
const auto member = call.begin();
const auto& arguments = member.value();
tc.name = CleanToolName(member.key());
const auto argument_source =
source != nullptr ? source->singleton_value : std::optional<std::string_view>{};
SetArguments(tc, arguments, argument_source);
Expand Down
23 changes: 4 additions & 19 deletions sdk_v2/cpp/test/asan/lsan.supp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,26 +29,11 @@ leak:cf_ssl_scache_peer_init
# --- Azure SDK: process-static CURLSH wrapper.
leak:CURLSHWrapper

# --- ORT GenAI C++ wrapper bug: OgaMultiModalProcessor::Process{Images,Audios,
# ImagesAndAudios}(vector<const char*>, ...) overloads in ort_genai.h allocate
# an OgaStringArray via OgaCreateStringArrayFromStrings but never call
# OgaDestroyStringArray on it. Fixed upstream in ort.genai (D:\src\github\ort.genai);
# remove this suppression once the SDK consumes a release containing the fix.
# https://github.com/microsoft/onnxruntime-genai/pull/2153
leak:OgaCreateStringArrayFromStrings

# --- ORT GenAI C++ wrapper bug: OrtxTensorResultGetAt (in onnxruntime-extensions) which returns a
# heap-allocated TensorObject that the C++ wrapper never releases via OrtxDispose.
# remove this suppression once the SDK consumes a release containing the fix.
# https://github.com/microsoft/onnxruntime-genai/pull/2168
leak:OrtxTensorResultGetAt

# --- ORT GenAI bug: Generators::State::Run calls OrtSession::Run with an
# OrtValue** output array but the State never releases the returned output
# handles, leaking one OrtValue (24 B) plus its backing tensor buffers
# (multi-MB per call) for every Run. Observed across audio streaming tests.
# Remove once the SDK consumes a release containing the upstream fix.
# This is the source of the onnxruntime allocated leaks. Can be verified by
# running with `--integration-only --gtest_filter=StreamingAudioFixture.\*`
# https://github.com/microsoft/onnxruntime-genai/pull/2169
leak:Generators::State::Run
# microsoft/onnxruntime-genai#2169 was merged, but the leak still reproduces with
# GenAI 0.19.0. Verify with `--integration-only --gtest_filter=StreamingAudioFixture.\*`
# before removing this suppression.
leak:Generators::State::Run
Loading