bound the scales input index in onnx parseResize2

This commit is contained in:
Uwez Khan
2026-10-09 02:11:48 +05:30
parent 73a26a4231
commit fb889c2251
2 changed files with 26 additions and 0 deletions

View File

@@ -1932,6 +1932,10 @@ Arg ONNXImporter2::resolveConstThroughIdentity(Arg arg)
void ONNXImporter2::parseResize2(LayerParams& layerParams, const opencv_onnx::NodeProto& node_proto)
{
int ninputs = node_proto.input_size();
// Resize always carries the data input plus scales or sizes, so the smallest
// valid node has 2 inputs (opset-10 [X, scales]); opset-11+ adds roi/sizes.
// scalesInputId below assumes that, so reject a short input list before indexing.
CV_CheckGE(ninputs, 2, "DNN/ONNX: Resize requires at least 2 inputs");
layerParams.type = "Resize2";
String interp_mode = layerParams.get<String>("coordinate_transformation_mode", "half_pixel");

View File

@@ -3804,4 +3804,26 @@ TEST_P(Test_ONNX_layers, getUnconnectedOutLayers)
ASSERT_TRUE(layer);
}
// A Resize node with a single input makes the importer pick input index 2 for
// "scales" (opset-11 layout) although the node only carries index 0, reading past
// the node's input list. Loading such a model should fail cleanly, not out of bounds.
TEST(Test_ONNX_importer, parse_resize_too_few_inputs)
{
const unsigned char model[] = {
0x08, 0x0d, 0x3a, 0x61, 0x0a, 0x22, 0x0a, 0x01, 0x58, 0x12, 0x01, 0x59,
0x22, 0x06, 0x52, 0x65, 0x73, 0x69, 0x7a, 0x65, 0x2a, 0x12, 0x0a, 0x04,
0x6d, 0x6f, 0x64, 0x65, 0x22, 0x07, 0x6e, 0x65, 0x61, 0x72, 0x65, 0x73,
0x74, 0xa0, 0x01, 0x03, 0x12, 0x01, 0x67, 0x5a, 0x1b, 0x0a, 0x01, 0x58,
0x12, 0x16, 0x0a, 0x14, 0x08, 0x01, 0x12, 0x10, 0x0a, 0x02, 0x08, 0x01,
0x0a, 0x02, 0x08, 0x01, 0x0a, 0x02, 0x08, 0x04, 0x0a, 0x02, 0x08, 0x04,
0x62, 0x1b, 0x0a, 0x01, 0x59, 0x12, 0x16, 0x0a, 0x14, 0x08, 0x01, 0x12,
0x10, 0x0a, 0x02, 0x08, 0x01, 0x0a, 0x02, 0x08, 0x01, 0x0a, 0x02, 0x08,
0x04, 0x0a, 0x02, 0x08, 0x04, 0x42, 0x04, 0x0a, 0x00, 0x10, 0x0d
};
Net net;
EXPECT_NO_THROW(net = readNetFromONNX(reinterpret_cast<const char*>(model), sizeof(model)));
EXPECT_TRUE(net.empty());
}
}} // namespace