From 6bdfea8d4b3683605f47994e491770bc0bc6ce5d Mon Sep 17 00:00:00 2001
From: Chris Miceli <chris@miceli.net.au>
Date: Wed, 14 Oct 2020 11:59:44 +1100
Subject: [PATCH] libavfilter/dnn/dnn_backend{openvino, tf}: check memory alloc
 non-NULL

These previously would not check that the return value was non-null
meaning it was susceptible to a sigsegv. This checks those values.
---
 libavfilter/dnn/dnn_backend_openvino.c | 14 +++++++++++++-
 libavfilter/dnn/dnn_backend_tf.c       | 16 +++++++++++++++-
 2 files changed, 28 insertions(+), 2 deletions(-)

diff --git a/libavfilter/dnn/dnn_backend_openvino.c b/libavfilter/dnn/dnn_backend_openvino.c
index 495225d0b3..d510e162c6 100644
--- a/libavfilter/dnn/dnn_backend_openvino.c
+++ b/libavfilter/dnn/dnn_backend_openvino.c
@@ -141,8 +141,20 @@ static DNNReturnType get_output_ov(void *model, const char *input_name, int inpu
 {
     DNNReturnType ret;
     OVModel *ov_model = (OVModel *)model;
+    OVContext *ctx = &ov_model->ctx;
     AVFrame *in_frame = av_frame_alloc();
-    AVFrame *out_frame = av_frame_alloc();
+    AVFrame *out_frame = NULL;
+
+    if (!in_frame) {
+        av_log(ctx, AV_LOG_ERROR, "Failed to allocate memory for input frame\n");
+        return DNN_ERROR;
+    }
+    out_frame = av_frame_alloc();
+    if (!out_frame) {
+        av_log(ctx, AV_LOG_ERROR, "Failed to allocate memory for output frame\n");
+        av_frame_free(&in_frame);
+        return DNN_ERROR;
+    }
     in_frame->width = input_width;
     in_frame->height = input_height;
 
diff --git a/libavfilter/dnn/dnn_backend_tf.c b/libavfilter/dnn/dnn_backend_tf.c
index be860b11b5..7923e1db69 100644
--- a/libavfilter/dnn/dnn_backend_tf.c
+++ b/libavfilter/dnn/dnn_backend_tf.c
@@ -159,8 +159,22 @@ static DNNReturnType get_output_tf(void *model, const char *input_name, int inpu
 {
     DNNReturnType ret;
     TFModel *tf_model = (TFModel *)model;
+    TFContext *ctx = &tf_model->ctx;
     AVFrame *in_frame = av_frame_alloc();
-    AVFrame *out_frame = av_frame_alloc();
+    AVFrame *out_frame = NULL;
+
+    if (!in_frame) {
+        av_log(ctx, AV_LOG_ERROR, "Failed to allocate memory for input frame\n");
+        return DNN_ERROR;
+    }
+
+    out_frame = av_frame_alloc();
+    if (!out_frame) {
+        av_log(ctx, AV_LOG_ERROR, "Failed to allocate memory for output frame\n");
+        av_frame_free(&in_frame);
+        return DNN_ERROR;
+    }
+
     in_frame->width = input_width;
     in_frame->height = input_height;