asserts should not be used instead of ordinary input checks. Yet the native DNN backend did it: get_input_native() asserted that the first dimension was one, despite this value coming directly from the input file without having been sanitized.
Unified · Split
| @@ -232,6 +232,8 @@ DNNModel *ff_dnn_load_model_native(const char *model_filename, DNNFunctionType f · 231 unmodified lines | ||
| 232 | 232 | oprd->dims[dim] = (int32_t)avio_rl32(model_file_context); |
| 233 | 233 | dnn_size += 4; |
| 234 | 234 | } |
| 235 | + if (oprd->type == DOT_INPUT && oprd->dims[0] != 1) | |
| 236 | + goto fail; | |
| 235 | 237 | |
| 236 | 238 | oprd->isNHWC = 1; |
| 237 | 239 | } |