Skip to content

Fix use-after-free of IMGDNN network outputs. #2

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Feb 6, 2020
Merged

Fix use-after-free of IMGDNN network outputs. #2

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
08d8dff
Fix use-after-free of IMGDNN network outputs.
robquill Feb 6, 2020
6e63b53
Update src/backends/imgdnn/execution.cpp
robquill Feb 6, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 5 additions & 3 deletions src/backends/imgdnn/execution.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -151,9 +151,7 @@ ResultCode ANeuralNetworksExecution_setOutput(
BACKEND_CALL_RET(ret, imgdnnBindingAddOutput, execution->imgdnn_binding_,
execution->imgdnn_outputs_[uindex], img_memory);
IMGDNN_RETURN_ERR_IF_ERROR(ret);
// Store the memory objects to free them after the execution
execution->imgdnn_memories_.push_back(img_memory);
// Store the memory objects to be able to lock them later
// Store the memory objects to be able to lock and free them later
execution->host_output_memories.emplace_back(data, img_memory);
}
return ANEURALNETWORKS_NO_ERROR;
Expand Down Expand Up @@ -405,6 +403,10 @@ ResultCode ANeuralNetworksExecution_notifyWait(
ANEURALNETWORKS_BAD_DATA);
BACKEND_CALL_RET(ret, imgdnnMemoryUnlock, hom.img_mem);
IMGDNN_RETURN_ERR_IF_ERROR(ret);

// Destroy output memory now it's been read
BACKEND_CALL_RET(ret, imgdnnMemoryDestroy, hom.img_mem);
IMGDNN_RETURN_ERR_IF_ERROR(ret);
}
execution->host_output_memories.clear();
return ANEURALNETWORKS_NO_ERROR;
Expand Down