MediaPipe session calculator silently accepts malformed servable_version values #4717

Describe the bug

OpenVINOModelServerSessionCalculator::Open() parses the optional servable_version field using a local stou32() implementation in src/mediapipe_calculators/ovms/openvinomodelserversessioncalculator.cc.

This implementation calls std::stoul(str) without checking whether the entire input string was consumed.

As a result, partially numeric strings are silently accepted:

There is a second issue at the call site: parsing failures are converted to version 0 through value_or(0). In OVMS, version 0 selects the default model instance.

Consequently, malformed servable_version values can silently select an unintended model version instead of reporting invalid input.

To Reproduce

Inspect the local stou32() implementation in:

src/mediapipe_calculators/ovms/openvinomodelserversessioncalculator.cc

For example:

auto result = stou32("12abc");
// result contains 12 instead of nullopt
auto result2 = stou32("0x3");

// result2 contains 0 instead of nullopt

The result is then used in Open():

auto servableVersionOpt = stou32(servableVersionStr);

uint32_t servableVersion = servableVersionOpt.value_or(0);

auto session = std::make_shared<OVMSInferenceAdapter>(

servableName, servableVersion);

Expected behavior

When servable_version is explicitly provided, the calculator should reject malformed or partially numeric values instead of silently truncating them or falling back to version 0.

When the field is omitted, the existing default model-version behavior should remain unchanged.

Additional context

The shared ovms::stou32() implementation in src/stringutils.cpp was already fixed to reject partial parses in PR #4555.

However, the MediaPipe session calculator contains a separate local copy of the older implementation. This copy was introduced later during the MediaPipe integration refactor in PR #4606.

The local implementation therefore does not benefit from the existing shared-helper fix.

A possible solution is to reuse the shared conversion helper and distinguish an omitted servable_version from a supplied but invalid value, preserving the current default behavior only when the field is absent.

OpenVINOModelServerSessionCalculator::Open() parses the optional servable_version field using a local stou32() implementation in src/mediapipe_calculators/ovms/openvinomodelserversessioncalculator.cc.

This implementation calls std::stoul(str) without checking whether the entire input string was consumed.

As a result, partially numeric strings are silently accepted:

There is a second issue at the call site: parsing failures are converted to version 0 through value_or(0). In OVMS, version 0 selects the default model instance.

Consequently, malformed servable_version values can silently select an unintended model version instead of reporting invalid input.

To Reproduce

Inspect the local stou32() implementation in:

src/mediapipe_calculators/ovms/openvinomodelserversessioncalculator.cc

For example:

auto result = stou32("12abc");
// result contains 12 instead of nullopt

auto result2 = stou32("0x3");
// result2 contains 0 instead of nullopt

The result is then used in Open():

auto servableVersionOpt = stou32(servableVersionStr);
uint32_t servableVersion = servableVersionOpt.value_or(0);

auto session = std::make_shared<OVMSInferenceAdapter>(
    servableName, servableVersion);

Expected behavior

When servable_version is explicitly provided, the calculator should reject malformed or partially numeric values instead of silently truncating them or falling back to version 0.

When the field is omitted, the existing default model-version behavior should remain unchanged.

Additional context

The shared ovms::stou32() implementation in src/stringutils.cpp was already fixed to reject partial parses in [PR #4555](#4555).

However, the MediaPipe session calculator contains a separate local copy of the older implementation. This copy was introduced later during the MediaPipe integration refactor in [PR #4606](#4606).

The local implementation therefore does not benefit from the existing shared-helper fix.

A possible solution is to reuse the shared conversion helper and distinguish an omitted servable_version from a supplied but invalid value, preserving the current default behavior only when the field is absent.