This is an automated email from the git hooks/post-receive script.
Git pushed a commit to branch master
in repository ffmpeg.
The following commit(s) were added to refs/heads/master by this push:
new 459436357d avfilter/dnn: zero-initialize the output-probe task
459436357d is described below
commit 459436357d1e5d13531bf7d93cd0f29352ea5ff5
Author: Jake Fineman <[email protected]>
AuthorDate: Tue Sep 29 22:05:26 2026 -0400
Commit: michaelni <[email protected]>
CommitDate: Fri Oct 16 01:43:20 2026 +0000
avfilter/dnn: zero-initialize the output-probe task
get_output_tf() (dnn_backend_tf.c) and get_output_ov()
(dnn_backend_openvino.c) both declare `TaskItem task;` uninitialized
and then unconditionally free task.in_frame/task.out_frame on their
error path:
ret = ff_dnn_fill_gettingoutput_task(&task, ...);
if (ret != 0)
goto err;
...
err:
av_frame_free(&task.out_frame);
av_frame_free(&task.in_frame);
ff_dnn_fill_gettingoutput_task() (dnn_backend_common.c) allocates
in_frame first and, only if that succeeds, allocates out_frame and
assigns both pointers into exec_params (and from there into the
task via ff_dnn_fill_task()). If the first av_frame_alloc() fails,
the function returns AVERROR(ENOMEM) immediately, before task.in_frame
or task.out_frame is ever set. The two probes then reach `err:` with
task's frame fields holding whatever garbage was on the stack, and
av_frame_free() dereferences those pointers.
Fix by zero-initializing the declaration, matching get_output_onnx()
(dnn_backend_onnx.c) and get_output_th() (dnn_backend_torch.cpp),
which already use `TaskItem task = { 0 };` and are not affected.
Reported by Forgejo_Fairy, review 8971 on #24761, which also
confirmed the defect predates that series and is already present at
6246f7a4cde6.
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Signed-off-by: Jake Fineman <[email protected]>
---
libavfilter/dnn/dnn_backend_openvino.c | 2 +-
libavfilter/dnn/dnn_backend_tf.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/libavfilter/dnn/dnn_backend_openvino.c
b/libavfilter/dnn/dnn_backend_openvino.c
index 4a372f5f54..a5c3be835d 100644
--- a/libavfilter/dnn/dnn_backend_openvino.c
+++ b/libavfilter/dnn/dnn_backend_openvino.c
@@ -1280,7 +1280,7 @@ static int get_output_ov(DNNModel *model, const char
*input_name, int input_widt
int ret;
OVModel *ov_model = (OVModel *)model;
DnnContext *ctx = ov_model->ctx;
- TaskItem task;
+ TaskItem task = { 0 };
OVRequestItem *request;
DNNExecBaseParams exec_params = {
.input_name = input_name,
diff --git a/libavfilter/dnn/dnn_backend_tf.c b/libavfilter/dnn/dnn_backend_tf.c
index 6c72783f77..110ae2c509 100644
--- a/libavfilter/dnn/dnn_backend_tf.c
+++ b/libavfilter/dnn/dnn_backend_tf.c
@@ -315,7 +315,7 @@ static int get_output_tf(DNNModel *model, const char
*input_name, int input_widt
int ret;
TFModel *tf_model = (TFModel *)model;
DnnContext *ctx = tf_model->ctx;
- TaskItem task;
+ TaskItem task = { 0 };
TFRequestItem *request;
DNNExecBaseParams exec_params = {
.input_name = input_name,
--
To stop receiving notification emails like this one, please contact
[email protected].
_______________________________________________
ffmpeg-cvslog mailing list -- [email protected]
To unsubscribe send an email to [email protected]
