Skip to content

fix: reject malformed MediaPipe servable_version values - #4726

Open
Veditha08 wants to merge 1 commit into
openvinotoolkit:mainfrom
Veditha08:fix-mediapipe-servable-version-validation
Open

Veditha08 wants to merge 1 commit into
openvinotoolkit:mainfrom
Veditha08:fix-mediapipe-servable-version-validation

Conversation

@Veditha08

Copy link
Copy Markdown
Contributor

🛠 Summary

Fixes #4717

The MediaPipe session calculator's local stou32() implementation used std::stoul() without checking whether the entire input string was consumed. This allowed malformed values such as "12abc" and "3.9" to be silently accepted as valid model versions.

Changes:

  • Reuses the shared ovms::stou32() parser.
  • Rejects explicitly supplied malformed or empty servable_version values with InvalidArgument.
  • Preserves the default version 0 when servable_version is omitted.
  • Removes the duplicate local parsing implementation.

🧪 Checklist

  • Unit tests added.
  • The documentation updated (not required for this internal validation fix).
  • Change follows security best practices.

Test results:

  • MediaPipe version validation tests: 5/5 passed.
  • StringUtils tests: 16/16 passed.
  • Calculator library build successful.
  • clang-format 6.0.1 check passed.
  • git diff --check passed.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

MediaPipe session calculator silently accepts malformed servable_version values

1 participant