[FFmpeg-cvslog] libavfilter/dnn/dnn_backend{openvino, tf}: check memory alloc non-NULL

[Chris Miceli]

ffmpeg | branch: master | Chris Miceli <chris at miceli.net.au> | Wed Oct 14 11:59:44 2020 +1100| [6bdfea8d4b3683605f47994e491770bc0bc6ce5d] | committer: Guo, Yejun

libavfilter/dnn/dnn_backend{openvino, tf}: check memory alloc non-NULL

These previously would not check that the return value was non-null
meaning it was susceptible to a sigsegv. This checks those values.

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=6bdfea8d4b3683605f47994e491770bc0bc6ce5d
---

 libavfilter/dnn/dnn_backend_openvino.c | 14 +++++++++++++-
 libavfilter/dnn/dnn_backend_tf.c       | 16 +++++++++++++++-
 2 files changed, 28 insertions(+), 2 deletions(-)

diff --git a/libavfilter/dnn/dnn_backend_openvino.c b/libavfilter/dnn/dnn_backend_openvino.c
index 495225d0b3..d510e162c6 100644
--- a/libavfilter/dnn/dnn_backend_openvino.c
+++ b/libavfilter/dnn/dnn_backend_openvino.c
@@ -141,8 +141,20 @@ static DNNReturnType get_output_ov(void *model, const char *input_name, int inpu
 {
     DNNReturnType ret;
     OVModel *ov_model = (OVModel *)model;
+    OVContext *ctx = &ov_model->ctx;
     AVFrame *in_frame = av_frame_alloc();
-    AVFrame *out_frame = av_frame_alloc();
+    AVFrame *out_frame = NULL;
+
+    if (!in_frame) {
+        av_log(ctx, AV_LOG_ERROR, "Failed to allocate memory for input frame\n");
+        return DNN_ERROR;
+    }
+    out_frame = av_frame_alloc();
+    if (!out_frame) {
+        av_log(ctx, AV_LOG_ERROR, "Failed to allocate memory for output frame\n");
+        av_frame_free(&in_frame);
+        return DNN_ERROR;
+    }
     in_frame->width = input_width;
     in_frame->height = input_height;
 
diff --git a/libavfilter/dnn/dnn_backend_tf.c b/libavfilter/dnn/dnn_backend_tf.c
index be860b11b5..7923e1db69 100644
--- a/libavfilter/dnn/dnn_backend_tf.c
+++ b/libavfilter/dnn/dnn_backend_tf.c
@@ -159,8 +159,22 @@ static DNNReturnType get_output_tf(void *model, const char *input_name, int inpu
 {
     DNNReturnType ret;
     TFModel *tf_model = (TFModel *)model;
+    TFContext *ctx = &tf_model->ctx;
     AVFrame *in_frame = av_frame_alloc();
-    AVFrame *out_frame = av_frame_alloc();
+    AVFrame *out_frame = NULL;
+
+    if (!in_frame) {
+        av_log(ctx, AV_LOG_ERROR, "Failed to allocate memory for input frame\n");
+        return DNN_ERROR;
+    }
+
+    out_frame = av_frame_alloc();
+    if (!out_frame) {
+        av_log(ctx, AV_LOG_ERROR, "Failed to allocate memory for output frame\n");
+        av_frame_free(&in_frame);
+        return DNN_ERROR;
+    }
+
     in_frame->width = input_width;
     in_frame->height = input_height;