Repository navigation
Description
Describe the bug
A critical process crash (SIGABRT / LOG(FATAL)) occurs in src/http_frontend/http_graph_executor_impl.cpp within onPacketReadySerializeImpl(). the function performs an unguarded extraction of string from an incoming mediapipe::Packet:
Status onPacketReadySerializeImpl(
const std::string& requestId,
const std::string& endpointName,
const std::string& endpointVersion,
const std::string& packetName,
const mediapipe_packet_type_enum packetType,
const ::mediapipe::Packet& packet,
std::string& response) {
response = packet.Get<std::string>();
return StatusCode::OK;
}in Google MediaPipe's implementation calling packet.Get<T>() invokes two internal Abseil assertions:
-ABSL_CHECK(!IsEmpty())
-ABSL_CHECK(ValidateAsType<T>().ok())
If an output packet is empty (e.g., timestamp propagation, stream synchronization bounds, or stream closure), or holds any type other than string (e.g., ov::Tensor, mediapipe::Tensor, mediapipe::ImageFrame, or integers), the ABSL_CHECK assertion fails, logging a fatal message to stderr and immediately terminating the process via abort() (SIGABRT).
Because ABSL_CHECK invokes abort() rather than throwing a C++ exception, the surrounding try { ... } catch (...) block in src/mediapipe_internal/mediapipegraphexecutor.hpp is completely bypassed. This causes the entire OVMS multi-threaded server daemon to crash immediately, resulting in a Denial of Service (DoS) for all connected clients and hosted models.
Also, the parameter const mediapipe_packet_type_enum packetType is accepted but completely ignored, unlike in src/kfs_frontend/kfs_graph_executor_impl.cpp:L1144-L1170 where it is used to safely route packets to corresponding deserializers.
To Reproduce
Add the following unit test to src/test/mediapipeflow_test.cpp :
// include it at top
#include "../http_frontend/http_graph_executor_impl.hpp"
// Test Case 1: Empty packet triggers ABSL_CHECK(!IsEmpty())
TEST(HttpGraphExecutorDeathTest, CrashOnEmptyPacket) {
::mediapipe::Packet emptyPacket;
std::string response;
EXPECT_DEATH({
ovms::onPacketReadySerializeImpl(
"req_id", "endpoint", "1", "output_stream",
ovms::mediapipe_packet_type_enum::UNKNOWN,
emptyPacket,
response);
}, ".*The packet is empty.*");
}
// Test Case 2: Non-string packet triggers ABSL_CHECK(ValidateAsType<T>().ok())
TEST(HttpGraphExecutorDeathTest, CrashOnNonStringType) {
::mediapipe::Packet intPacket = ::mediapipe::MakePacket<int>(42);
std::string response;
EXPECT_DEATH({
ovms::onPacketReadySerializeImpl(
"req_id", "endpoint", "1", "output_stream",
ovms::mediapipe_packet_type_enum::OVTENSOR,
intPacket,
response);
}, ".*The Packet stores .* but is being accessed as .*string.*");
}Run the test:
bazel test //src:ovms_test --test_filter="HttpGraphExecutorDeathTest.*" --test_output=allExpected behavior
onPacketReadySerializeImpl()should validate that the packet is not empty (!packet.IsEmpty()) and that its stored type matchesstd::string(packet.ValidateAsType<std::string>().ok()).- If an empty or incompatible packet arrives:
- For empty packets, it should handle them gracefully (e.g., clear response or ignore control packets) and return
StatusCode::OK. - For type mismatches, it should log an error and return an appropriate
ovms::Status(e.g.,Status(StatusCode::MEDIAPIPE_EXECUTION_ERROR, "Invalid packet payload type for HTTP output")).
- For empty packets, it should handle them gracefully (e.g., clear response or ignore control packets) and return
- The server should return an HTTP 4xx/5xx error JSON payload to the client without terminating the daemon process.
Logs
F0000 00:00:00.000000 ... packet.h:352] Check failed: !IsEmpty() The packet is empty.
*** Check failure stack trace: ***
@ 0x7f48a12b4000 absl::log_internal::LogMessageFatal::~LogMessageFatal()
@ 0x55bc1489d123 mediapipe::Packet::Get<std::string>()
@ 0x55bc1482a456 ovms::onPacketReadySerializeImpl() at src/http_frontend/http_graph_executor_impl.cpp:95
@ 0x55bc1483b789 ovms::MediapipeGraphExecutor::inferTyped<>() at src/mediapipe_internal/mediapipegraphexecutor.hpp:404
@ 0x55bc1481a102 ovms::HttpRestApiHandler::processV3Request() at src/http_frontend/http_rest_api_handler.cpp:706
Aborted (core dumped)
Configuration
- OVMS version- main (latest commit)
- OS: Linux (Ubuntu x86_64)
Activity