OSSForks/opencv
1
0
Fork 0
mirror of https://github.com/zebrajr/opencv.git synced 2026-01-15 12:15:17 +00:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

Merge pull request #28272 from abhishek-gola:heap_overflow_fix

Browse Source 
Fixed heap-buffer-overflow in DNN NaryEltwiseLayer
This commit is contained in:
Alexander Smorkalov
2025-12-23 08:52:16 +03:00
committed by GitHub
parent ad9387340a f86bdfcff4
commit 031e7de85c
1 changed files with 8 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
modules/dnn/src/layers/nary_eltwise_layers.cpp
View File

@@ -466,8 +466,8 @@ public:
int nplanes = std::accumulate(shape.begin(), shape.end() - 1, 1, std::multiplies<int>());
if (nplanes == 1) { // parallelize within the plane
AutoBuffer<char> buf_ptrs(steps.size());
auto ptrs = (char**)buf_ptrs.data();
AutoBuffer<char*> buf_ptrs(steps.size());
char** ptrs = buf_ptrs.data();
ptrs[0] = out;
for (int i = 0; i < ninputs; i++) {
ptrs[i+1] = (char*)inp[i];
@@ -481,7 +481,7 @@ public:
ptr[i] = op(ptr1[i], ptr2[i]);
}
for (int j = 2; j < ninputs; j++) {
int dpj = steps[j + 1].back();
size_t dpj = steps[j + 1].back() / sizeof(T);
const T* ptrj = (const T*)(ptrs[j + 1]);
if (dpj == 1) {
for (int i = r.start; i < r.end; i++) {
@@ -500,7 +500,7 @@ public:
}
ptr = tmp;
for (int j = 2; j < ninputs; j++) {
int dpj = steps[j + 1].back();
size_t dpj = steps[j + 1].back() / sizeof(T);
const T* ptr_j = (const T*)(ptrs[j + 1]);
for (int i = r.start; i < r.end; i++, ptr += dp, ptr_j += dpj) {
*ptr = saturate_cast<T>(op(*ptr, *ptr_j) * scale);
@@ -512,8 +512,8 @@ public:
parallel_for_(Range(0, plane_size), worker, nstripes);
} else { // parallelize across the plane
auto worker = [&](const Range &r) {
AutoBuffer<char> buf_ptrs(steps.size());
auto ptrs = (char**)buf_ptrs.data();
AutoBuffer<char*> buf_ptrs(steps.size());
char** ptrs = buf_ptrs.data();
for (int plane_idx = r.start; plane_idx < r.end; plane_idx++) {
ptrs[0] = out;
for (int i = 0; i < ninputs; i++) ptrs[i+1] = (char*)inp[i];
@@ -535,7 +535,7 @@ public:
ptr[i] = saturate_cast<T>(op(ptr1[i], ptr2[i]) * scale);
}
for (int j = 2; j < ninputs; j++) {
int dpj = steps[j + 1].back();
size_t dpj = steps[j + 1].back() / sizeof(T);
const T* ptrj = (const T*)(ptrs[j + 1]);
if (dpj == 1) {
for (int i = 0; i < plane_size; i++) {
@@ -554,7 +554,7 @@ public:
}
ptr = tmp;
for (int j = 2; j < ninputs; j++) {
int dpj = steps[j + 1].back();
size_t dpj = steps[j + 1].back() / sizeof(T);
const T* ptrj = (const T*)(ptrs[j + 1]);
for (int i = 0; i < plane_size; i++, ptr += dp, ptrj += dpj) {
*ptr = op(*ptr, saturate_cast<T>(*ptrj * scale));