From 2c31cf561f840c3f928054c3c745dbdb2037fded Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Tue, 13 Oct 2026 06:10:50 +0200
Subject: [PATCH] avfilter/dnn_backend_openvino: do not free the input layouts
 twice

Fixes: o7gnt6oof6Qd
Fixes: use after free
Fixes: double free
Heap use after free after an allocation failure Replicated through UnModified FFmpeg with ASAN, the allocation failure injected through an LD_PRELOAD shim
Double free Replicated through UnModified FFmpeg with gdb, a crafted 8192x8192 PNG, input_resizable=1 and vm.overcommit_memory=2
Found during triage of the review of https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24617
---
 libavfilter/dnn/dnn_backend_openvino.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/libavfilter/dnn/dnn_backend_openvino.c b/libavfilter/dnn/dnn_backend_openvino.c
index 1b681520e2..f8e1cd2dcd 100644
--- a/libavfilter/dnn/dnn_backend_openvino.c
+++ b/libavfilter/dnn/dnn_backend_openvino.c
@@ -800,7 +800,9 @@ static int init_model_ov(OVModel *ov_model, const char *input_name, const char *
     ov_preprocess_input_model_info_free(input_model_info);
     input_model_info = NULL;
     ov_layout_free(NCHW_layout);
+    NCHW_layout = NULL;
     ov_layout_free(NHWC_layout);
+    NHWC_layout = NULL;
 #else
     if (ctx->batch_size > 1) {
         input_shapes_t input_shapes;