fix: free Content object in error paths of loadModelFile/createFromBuffer

source/backend/cpu/compute/ImageProcessFunction.cpp

@@ -273,7 +273,7 @@ void MNNC3ToXYZ(const unsigned char* source, unsigned char* dest, size_t count,
         C3 = coeffs[r1], C4 = coeffs[4], C5 = coeffs[b1],
         C6 = coeffs[r2], C7 = coeffs[7], C8 = coeffs[b2];
     int sta = 0;
-    
+
 #if defined MNN_USE_NEON
     int countD8 = (int)count / 8;
     if (countD8 > 0) {
@@ -282,7 +282,7 @@ void MNNC3ToXYZ(const unsigned char* source, unsigned char* dest, size_t count,
         sta = countD8 * 8;
     }
 #endif
-    
+
     for (int i = sta; i < count; ++i) {
         int r = source[3 * i + 0];
         int g = source[3 * i + 1];
@@ -333,7 +333,7 @@ void MNNC3ToBGR555(const unsigned char* source, unsigned char* dest, size_t coun
         } else {
             MNNRGBToBGR555Fast(source, dest, countD8);
         }
-        
+
         i = countD8 * 8;
     }
 #endif
@@ -755,8 +755,8 @@ static void _sampleBilinearCommon(const unsigned char* source, unsigned char* de
         float x  = __clamp(curPoints.fX, 0, xMax);
         int y0   = (int)y;
         int x0   = (int)x;
-        int y1   = (int)ceilf(y);
-        int x1   = (int)ceilf(x);
+        int y1   = std::min((int)ceilf(y), (int)(ih - 1));
+        int x1   = std::min((int)ceilf(x), (int)(iw - 1));
         float xF = x - (float)x0;
         float yF = y - (float)y0;
 

source/backend/qnn/backend/QNNBackend.cpp

@@ -634,7 +634,11 @@ static bool deepCopyQnnTensorInfo(Qnn_Tensor_t *dst, const Qnn_Tensor_t *src) {
   if (!tensorName) {
     QNN_TENSOR_SET_NAME(dst, nullptr);
   } else {
-    QNN_TENSOR_SET_NAME(dst, ::strdup(tensorName));
+    char *nameCopy = ::strdup(tensorName);
+    if (!nameCopy) {
+      return false;
+    }
+    QNN_TENSOR_SET_NAME(dst, nameCopy);
   }
   QNN_TENSOR_SET_ID(dst, QNN_TENSOR_GET_ID(src));
   QNN_TENSOR_SET_TYPE(dst, QNN_TENSOR_GET_TYPE(src));
@@ -659,31 +663,40 @@ static bool deepCopyQnnTensorInfo(Qnn_Tensor_t *dst, const Qnn_Tensor_t *src) {
       qParams.axisScaleOffsetEncoding.scaleOffset = (Qnn_ScaleOffset_t *)malloc(
           QNN_TENSOR_GET_QUANT_PARAMS(src).axisScaleOffsetEncoding.numScaleOffsets *
           sizeof(Qnn_ScaleOffset_t));
-      if (qParams.axisScaleOffsetEncoding.scaleOffset) {
-        for (size_t idx = 0;
-             idx < QNN_TENSOR_GET_QUANT_PARAMS(src).axisScaleOffsetEncoding.numScaleOffsets;
-             idx++) {
-          qParams.axisScaleOffsetEncoding.scaleOffset[idx].scale =
-              QNN_TENSOR_GET_QUANT_PARAMS(src).axisScaleOffsetEncoding.scaleOffset[idx].scale;
-          qParams.axisScaleOffsetEncoding.scaleOffset[idx].offset =
-              QNN_TENSOR_GET_QUANT_PARAMS(src).axisScaleOffsetEncoding.scaleOffset[idx].offset;
-        }
+      if (!qParams.axisScaleOffsetEncoding.scaleOffset) {
+        free((void *)QNN_TENSOR_GET_NAME(dst));
+        return false;
+      }
+      for (size_t idx = 0;
+           idx < QNN_TENSOR_GET_QUANT_PARAMS(src).axisScaleOffsetEncoding.numScaleOffsets;
+           idx++) {
+        qParams.axisScaleOffsetEncoding.scaleOffset[idx].scale =
+            QNN_TENSOR_GET_QUANT_PARAMS(src).axisScaleOffsetEncoding.scaleOffset[idx].scale;
+        qParams.axisScaleOffsetEncoding.scaleOffset[idx].offset =
+            QNN_TENSOR_GET_QUANT_PARAMS(src).axisScaleOffsetEncoding.scaleOffset[idx].offset;
       }
     }
   }
   QNN_TENSOR_SET_QUANT_PARAMS(dst, qParams);
   QNN_TENSOR_SET_RANK(dst, QNN_TENSOR_GET_RANK(src));
   QNN_TENSOR_SET_DIMENSIONS(dst, nullptr);
+  QNN_TENSOR_SET_IS_DYNAMIC_DIMENSIONS(dst, nullptr);
   if (QNN_TENSOR_GET_RANK(src) > 0) {
     QNN_TENSOR_SET_DIMENSIONS(dst, (uint32_t *)malloc(QNN_TENSOR_GET_RANK(src) * sizeof(uint32_t)));
-    if (QNN_TENSOR_GET_DIMENSIONS(dst)) {
-      ::memcpy(QNN_TENSOR_GET_DIMENSIONS(dst),
-                             QNN_TENSOR_GET_DIMENSIONS(src),
-                             QNN_TENSOR_GET_RANK(src) * sizeof(uint32_t));
+    if (!QNN_TENSOR_GET_DIMENSIONS(dst)) {
+      freeQnnTensor(*dst);
+      return false;
     }
+    ::memcpy(QNN_TENSOR_GET_DIMENSIONS(dst),
+                           QNN_TENSOR_GET_DIMENSIONS(src),
+                           QNN_TENSOR_GET_RANK(src) * sizeof(uint32_t));
     if (QNN_TENSOR_GET_IS_DYNAMIC_DIMENSIONS(src)) {
       QNN_TENSOR_SET_IS_DYNAMIC_DIMENSIONS(
           dst, (uint8_t *)malloc(QNN_TENSOR_GET_RANK(src) * sizeof(uint8_t)));
+      if (!QNN_TENSOR_GET_IS_DYNAMIC_DIMENSIONS(dst)) {
+        freeQnnTensor(*dst);
+        return false;
+      }
       ::memcpy(QNN_TENSOR_GET_IS_DYNAMIC_DIMENSIONS(dst),
                              QNN_TENSOR_GET_IS_DYNAMIC_DIMENSIONS(src),
                              QNN_TENSOR_GET_RANK(src) * sizeof(uint8_t));

source/core/Interpreter.cpp

@@ -81,6 +81,7 @@ static Content* loadModelFile(const char* file) {
     auto net     = new Content;
     bool success = loader->merge(net->buffer);
     if (!success) {
+        delete net;
         return nullptr;
     }
     loader.reset();
@@ -105,7 +106,8 @@ Interpreter* Interpreter::createFromBuffer(const void* buffer, size_t size) {
     auto net = new Content;
     net->buffer.reset((int)size);
     if (nullptr == net->buffer.get()) {
-        MNN_ERROR("Memory not enought!\n");
+        MNN_ERROR("Memory not enough!\n");
+        delete net;
         return nullptr;
     }
     ::memcpy(net->buffer.get(), buffer, size);
@@ -120,6 +122,7 @@ Interpreter* Interpreter::createFromBufferInternal(Content* net, bool enforceAut
     }
     auto valid = OpCommonUtils::checkNet(net->buffer.get(), net->buffer.size());
     if (!valid) {
+        delete net;
         return nullptr;
     }
     net->net = GetNet(net->buffer.get());