From 6385511e88f188436c462d334cb4bcc4aa9c629b Mon Sep 17 00:00:00 2001 From: Alexander Alekhin Date: Fri, 24 Dec 2021 00:14:17 +0000 Subject: [PATCH] dnn: add checks in pooling layer implementation - to avoid out of buffer access --- modules/dnn/src/layers/pooling_layer.cpp | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/modules/dnn/src/layers/pooling_layer.cpp b/modules/dnn/src/layers/pooling_layer.cpp index e79aa367d3..7067270ed6 100644 --- a/modules/dnn/src/layers/pooling_layer.cpp +++ b/modules/dnn/src/layers/pooling_layer.cpp @@ -1113,9 +1113,16 @@ virtual Ptr initNgraph(const std::vector >& inp } else if (padMode.empty()) { - int addedDims = isPool1D? inpShape.size() : local_kernel.size(); - for (int i = 0; i < addedDims; i++) { + size_t addedDims = isPool1D? inpShape.size() : local_kernel.size(); + CV_CheckLE(addedDims, inpShape.size(), ""); + CV_CheckLE(addedDims, pads_begin.size(), ""); + CV_CheckLE(addedDims, pads_end.size(), ""); + CV_CheckLE(addedDims, local_kernel.size(), ""); + CV_CheckLE(addedDims, strides.size(), ""); + for (int i = 0; i < addedDims; i++) + { float dst = (float) (inpShape[i] + pads_begin[i] + pads_end[i] - local_kernel[i]) / strides[i]; + CV_CheckGE(dst, 0.0f, ""); outShape.push_back(1 + (ceilMode ? ceil(dst) : floor(dst))); }