dnn: add checks in pooling layer implementation

- to avoid out of buffer access
reeceGitHub · Dec 24, 2021 · 6385511 · 6385511
1 parent f11ab4c
commit 6385511
Showing 1 changed file with 9 additions and 2 deletions.
diff --git a/modules/dnn/src/layers/pooling_layer.cpp b/modules/dnn/src/layers/pooling_layer.cpp
@@ -1113,9 +1113,16 @@ virtual Ptr<BackendNode> initNgraph(const std::vector<Ptr<BackendWrapper> >& inp
             }
             else if (padMode.empty())
             {
-                int addedDims = isPool1D? inpShape.size() : local_kernel.size();
-                for (int i = 0; i < addedDims; i++) {
+                size_t addedDims = isPool1D? inpShape.size() : local_kernel.size();
+                CV_CheckLE(addedDims, inpShape.size(), "");
+                CV_CheckLE(addedDims, pads_begin.size(), "");
+                CV_CheckLE(addedDims, pads_end.size(), "");
+                CV_CheckLE(addedDims, local_kernel.size(), "");
+                CV_CheckLE(addedDims, strides.size(), "");
+                for (int i = 0; i < addedDims; i++)
+                {
                     float dst = (float) (inpShape[i] + pads_begin[i] + pads_end[i] - local_kernel[i]) / strides[i];
+                    CV_CheckGE(dst, 0.0f, "");
                     outShape.push_back(1 + (ceilMode ? ceil(dst) : floor(dst)));
                 }