PR #24617 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24617 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24617.patch
Found-by: zhang xingxing Fixes: out of array read Fixes: WobrPAzJQZg5 >From 5f4d86a7608cd222ce4512d55af6796472eab211 Mon Sep 17 00:00:00 2001 From: zhang xingxing <[email protected]> Date: Mon, 21 Sep 2026 21:38:56 +0200 Subject: [PATCH 1/2] avfilter/dnn/dnn_backend_openvino: reject model inputs that are not 4-dimensional Found-by: zhang xingxing Fixes: out of array read Fixes: WobrPAzJQZg5 --- libavfilter/dnn/dnn_backend_openvino.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/libavfilter/dnn/dnn_backend_openvino.c b/libavfilter/dnn/dnn_backend_openvino.c index 0df4d585e8..915e5e1a14 100644 --- a/libavfilter/dnn/dnn_backend_openvino.c +++ b/libavfilter/dnn/dnn_backend_openvino.c @@ -1086,6 +1086,11 @@ static int get_input_ov(DNNModel *model, DNNData *input, const char *input_name) av_log(ctx, AV_LOG_ERROR, "Failed to get input port shape.\n"); return ov2_map_error(status, NULL); } + if (input_shape.rank != 4) { + av_log(ctx, AV_LOG_ERROR, "Input has %"PRId64" dimensions, only 4-dimensional inputs are supported.\n", input_shape.rank); + ov_shape_free(&input_shape); + return AVERROR(ENOSYS); + } for (int i = 0; i < 4; i++) input->dims[i] = input_shape.dims[i]; -- 2.52.0 >From 1faac5ea4586e1953f49a3e8d58faaaedfe37001 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Mon, 21 Sep 2026 21:40:59 +0200 Subject: [PATCH 2/2] avfilter/dnn/dnn_backend_openvino: return an error when an output port cannot be looked up Found during triage/review of the security report WobrPAzJQZg5 Fixes: null pointer dereference --- libavfilter/dnn/dnn_backend_openvino.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libavfilter/dnn/dnn_backend_openvino.c b/libavfilter/dnn/dnn_backend_openvino.c index 915e5e1a14..4a372f5f54 100644 --- a/libavfilter/dnn/dnn_backend_openvino.c +++ b/libavfilter/dnn/dnn_backend_openvino.c @@ -780,11 +780,13 @@ static int init_model_ov(OVModel *ov_model, const char *input_name, const char * &ov_model->output_ports[i]); if (status != OK) { av_log(ctx, AV_LOG_ERROR, "Failed to get output port %s.\n", output_names[i]); + ret = ov2_map_error(status, NULL); goto err; } status = ov_port_get_any_name(ov_model->output_ports[i], &port_name); if (status != OK) { av_log(ctx, AV_LOG_ERROR, "Failed to get output port name.\n"); + ret = ov2_map_error(status, NULL); goto err; } av_log(ctx, AV_LOG_VERBOSE, "OpenVINO model outputs: %s\n", port_name); -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
