Commit 459436357d for ffmpeg

commit 459436357d1e5d13531bf7d93cd0f29352ea5ff5
Author: Jake Fineman <jake@wave.online>
Date:   Tue Sep 29 22:05:26 2026 -0400

    avfilter/dnn: zero-initialize the output-probe task

    get_output_tf() (dnn_backend_tf.c) and get_output_ov()
    (dnn_backend_openvino.c) both declare `TaskItem task;` uninitialized
    and then unconditionally free task.in_frame/task.out_frame on their
    error path:

        ret = ff_dnn_fill_gettingoutput_task(&task, ...);
        if (ret != 0)
            goto err;
        ...
    err:
        av_frame_free(&task.out_frame);
        av_frame_free(&task.in_frame);

    ff_dnn_fill_gettingoutput_task() (dnn_backend_common.c) allocates
    in_frame first and, only if that succeeds, allocates out_frame and
    assigns both pointers into exec_params (and from there into the
    task via ff_dnn_fill_task()). If the first av_frame_alloc() fails,
    the function returns AVERROR(ENOMEM) immediately, before task.in_frame
    or task.out_frame is ever set. The two probes then reach `err:` with
    task's frame fields holding whatever garbage was on the stack, and
    av_frame_free() dereferences those pointers.

    Fix by zero-initializing the declaration, matching get_output_onnx()
    (dnn_backend_onnx.c) and get_output_th() (dnn_backend_torch.cpp),
    which already use `TaskItem task = { 0 };` and are not affected.

    Reported by Forgejo_Fairy, review 8971 on #24761, which also
    confirmed the defect predates that series and is already present at
    6246f7a4cde6.

    Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
    Signed-off-by: Jake Fineman <jake@wave.online>

diff --git a/libavfilter/dnn/dnn_backend_openvino.c b/libavfilter/dnn/dnn_backend_openvino.c
index 4a372f5f54..a5c3be835d 100644
--- a/libavfilter/dnn/dnn_backend_openvino.c
+++ b/libavfilter/dnn/dnn_backend_openvino.c
@@ -1280,7 +1280,7 @@ static int get_output_ov(DNNModel *model, const char *input_name, int input_widt
     int ret;
     OVModel *ov_model = (OVModel *)model;
     DnnContext *ctx = ov_model->ctx;
-    TaskItem task;
+    TaskItem task = { 0 };
     OVRequestItem *request;
     DNNExecBaseParams exec_params = {
         .input_name     = input_name,
diff --git a/libavfilter/dnn/dnn_backend_tf.c b/libavfilter/dnn/dnn_backend_tf.c
index 6c72783f77..110ae2c509 100644
--- a/libavfilter/dnn/dnn_backend_tf.c
+++ b/libavfilter/dnn/dnn_backend_tf.c
@@ -315,7 +315,7 @@ static int get_output_tf(DNNModel *model, const char *input_name, int input_widt
     int ret;
     TFModel *tf_model = (TFModel *)model;
     DnnContext *ctx = tf_model->ctx;
-    TaskItem task;
+    TaskItem task = { 0 };
     TFRequestItem *request;
     DNNExecBaseParams exec_params = {
         .input_name     = input_name,