From ee0cd2fb9e96b6cc68e918c986202b2505c4a7a3 Mon Sep 17 00:00:00 2001
From: Alexander Gutkin <agutkin@google.com>
Date: Tue, 5 May 2026 14:09:54 -0700
Subject: [PATCH] `VectorFst`: Add sanity checks for reading the start state
 and the next state for the rest of the states.

PiperOrigin-RevId: 910904063
---
 openfst/lib/vector-fst.h | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/openfst/lib/vector-fst.h b/openfst/lib/vector-fst.h
index 892e4634..a708c018 100644
--- a/openfst/lib/vector-fst.h
+++ b/openfst/lib/vector-fst.h
@@ -27,6 +27,7 @@
 #include <ios>
 #include <iosfwd>
 #include <istream>
+#include <limits>
 #include <memory>
 #include <optional>
 #include <ostream>
@@ -483,6 +484,8 @@ VectorFstImpl<S>* VectorFstImpl<S>::Read(std::istream& strm,
   impl->BaseImpl::SetStart(hdr.Start());
   if (hdr.NumStates() != kNoStateId) impl->ReserveStates(hdr.NumStates());
   StateId state = 0;
+  StateId max_next_state = std::numeric_limits<StateId>::lowest();
+  StateId min_next_state = std::numeric_limits<StateId>::max();
   for (; hdr.NumStates() == kNoStateId || state < hdr.NumStates(); ++state) {
     Weight weight;
     if (!weight.Read(strm)) break;
@@ -506,6 +509,8 @@ VectorFstImpl<S>* VectorFstImpl<S>::Read(std::istream& strm,
         LOG(ERROR) << "VectorFst::Read: Read failed: " << opts.source;
         return nullptr;
       }
+      if (arc.nextstate > max_next_state) max_next_state = arc.nextstate;
+      if (arc.nextstate < min_next_state) min_next_state = arc.nextstate;
       impl->BaseImpl::AddArc(state, std::move(arc));
     }
   }
@@ -513,6 +518,21 @@ VectorFstImpl<S>* VectorFstImpl<S>::Read(std::istream& strm,
     LOG(ERROR) << "VectorFst::Read: Unexpected end of file: " << opts.source;
     return nullptr;
   }
+  // Sanity check for the start state.
+  if (impl->Start() != kNoStateId && impl->Start() >= state) {
+    LOG(ERROR) << "VectorFst::Read: initial state " << impl->Start()
+               << " out of range [0, " << state << ")";
+    return nullptr;
+  }
+  // Sanity check on next states.
+  if (min_next_state < 0) {
+    LOG(ERROR) << "VectorFst::Read: Invalid arc.nextstate=" << min_next_state;
+    return nullptr;
+  }
+  if (max_next_state >= state) {
+    LOG(ERROR) << "VectorFst::Read: Invalid arc.nextstate=" << max_next_state;
+    return nullptr;
+  }
   return impl.release();
 }