Mkulakow/fixes - #4455
Open
michalkulakowski wants to merge 3 commits into
Open
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
This PR hardens request-to-tensor conversion and custom node behaviors, primarily by adding stricter validation for mixed image batches and malformed KFS BYTES payloads, plus a fix to cap object-detection outputs to max_output_batch.
Changes:
- Reject mixed-channel image batches when converting native file inputs (and add coverage for ranged channel dimensions).
- Harden KFS BYTES/string parsing against overflow/wrap-style malformed length prefixes.
- Fix
model_zoo_intel_object_detectionto resize all output vectors consistently when capping tomax_output_batch, and add a regression test.
Reviewed changes
Copilot reviewed 9 out of 9 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
src/test/tensor_conversion_test.cpp |
Adds negative tests for mixed-channel batches and malformed BYTES payloads (needs robust file-open/read checks). |
src/test/node_library_manager_test.cpp |
Adds regression test asserting object-detection node caps outputs to max_output_batch. |
src/tensor_conversion.hpp |
Adds mixed-channel-in-batch validation during native file input conversion. |
src/tensor_conversion.cpp |
Adds empty-batch guard and size-consistency check in createTensorFromMats. |
src/tensor_conversion_common.cpp |
Mirrors createTensorFromMats hardening in the common implementation. |
src/kfs_frontend/kfs_utils.cpp |
Reworks BYTES parsing to avoid accumulator overflow and out-of-bounds reads (uses memcpy + bounds checks). |
src/filesystem/s3filesystem.cpp |
Changes default scheme handling for custom S3 endpoints (potential behavior break for endpoints without an explicit scheme). |
src/custom_nodes/model_zoo_intel_object_detection/model_zoo_intel_object_detection.cpp |
Ensures all output vectors are resized consistently when capping results. |
src/custom_nodes/common/custom_node_library_internal_manager.hpp |
Fixes get_buffer() to avoid returning undersized queue buffers and avoids use of an uninitialized out-pointer. |
Suppressed comments (1)
src/test/tensor_conversion_test.cpp:629
- Same issue here: the test assumes grayscale.jpg can be opened and read; on failure, tellg() may return -1 and the test will allocate an enormous buffer.
std::ifstream grayscaleDataFile;
grayscaleDataFile.open(getGenericFullPathForSrcTest("/ovms/src/test/binaryutils/grayscale.jpg"), std::ios::binary);
grayscaleDataFile.seekg(0, std::ios::end);
size_t grayscaleFilesize = grayscaleDataFile.tellg();
grayscaleDataFile.seekg(0);
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+191
to
+197
| std::ifstream grayscaleDataFile; | ||
| grayscaleDataFile.open(getGenericFullPathForSrcTest("/ovms/src/test/binaryutils/grayscale.jpg"), std::ios::binary); | ||
| grayscaleDataFile.seekg(0, std::ios::end); | ||
| size_t grayscaleFilesize = grayscaleDataFile.tellg(); | ||
| grayscaleDataFile.seekg(0); | ||
| std::unique_ptr<char[]> grayscaleImageBytes(new char[grayscaleFilesize]); | ||
| grayscaleDataFile.read(grayscaleImageBytes.get(), grayscaleFilesize); |
Comment on lines
126
to
139
| config.endpointOverride = Aws::String(host_name + ":" + host_port); | ||
| config.scheme = Aws::Http::Scheme::HTTP; | ||
| config.scheme = Aws::Http::Scheme::HTTPS; | ||
| } | ||
| if (s3_endpoint != nullptr) { | ||
| std::string endpoint(s3_endpoint); | ||
| if (endpoint.rfind("http://") != std::string::npos) { | ||
| config.scheme = Aws::Http::Scheme::HTTPS; | ||
| if (endpoint.rfind("http://", 0) == 0) { | ||
| endpoint = endpoint.substr(7); | ||
| config.scheme = Aws::Http::Scheme::HTTP; | ||
| } else if (endpoint.rfind("https://", 0) == 0) { | ||
| endpoint = endpoint.substr(8); | ||
| } | ||
| config.endpointOverride = Aws::String(endpoint.c_str()); | ||
| config.scheme = Aws::Http::Scheme::HTTP; | ||
| } |
Collaborator
There was a problem hiding this comment.
Does it pass our minio validation ? Should we update documentation ?
| ov::Tensor tensor(precision, shape); | ||
| char* ptr = (char*)tensor.data(); | ||
| const size_t firstImageSizeBytes = images[0].total() * images[0].elemSize(); | ||
| for (cv::Mat image : images) { |
| ov::Tensor tensor(precision, shape); | ||
| char* ptr = (char*)tensor.data(); | ||
| const size_t firstImageSizeBytes = images[0].total() * images[0].elemSize(); | ||
| for (cv::Mat image : images) { |
mzegla
reviewed
Aug 17, 2026
Comment on lines
+330
to
+339
| if (headersLength > buffer->size()) { | ||
| break; | ||
| } | ||
| if (totalStringsLength > buffer->size() - headersLength) { | ||
| break; | ||
| } | ||
| const size_t currentOffset = totalStringsLength + headersLength; | ||
| if (buffer->size() - currentOffset < sizeof(uint32_t)) { | ||
| break; | ||
| } |
Collaborator
There was a problem hiding this comment.
Should we simply break from those conditions? Not return error?
rasapala
reviewed
Aug 17, 2026
rasapala
left a comment
rasapala
left a comment
Collaborator
There was a problem hiding this comment.
Copilot had good suggestions.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🛠 Summary
JIRA/Issue if applicable.
Describe the changes.
🧪 Checklist
``