Commit b060566909 for ffmpeg

commit b060566909d39884ee3a7205003e824421b448ed
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Tue Nov 3 16:13:38 2026 +0100

    avfilter/dnn_backend_tf: free all output tensors of a request

    This is not a security issue.

    Fixes: hYQpMVEPvybk
    Fixes: swarm-tf_free_request-always-frees-only-one-output-tensor-21656a

    Found-by: zhang xingxing <2388969553@qq.com>

    Memory leak Replicated through UnModified FFmpeg with LSan

    Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

diff --git a/libavfilter/dnn/dnn_backend_tf.c b/libavfilter/dnn/dnn_backend_tf.c
index f722e8bf8d..51dd88ce1c 100644
--- a/libavfilter/dnn/dnn_backend_tf.c
+++ b/libavfilter/dnn/dnn_backend_tf.c
@@ -54,6 +54,7 @@ typedef struct TFModel {
 typedef struct TFInferRequest {
     TF_Output *tf_outputs;
     TF_Tensor **output_tensors;
+    uint32_t nb_output;
     TF_Output *tf_input;
     TF_Tensor *input_tensor;
 } TFInferRequest;
@@ -100,8 +101,7 @@ static void tf_free_request(TFInferRequest *request)
     av_freep(&request->tf_input);
     av_freep(&request->tf_outputs);
     if (request->output_tensors) {
-        int nb_output = sizeof(*request->output_tensors)/sizeof(request->output_tensors[0]);
-        for (uint32_t i = 0; i < nb_output; ++i) {
+        for (uint32_t i = 0; i < request->nb_output; ++i) {
             if (request->output_tensors[i]) {
                 TF_DeleteTensor(request->output_tensors[i]);
                 request->output_tensors[i] = NULL;
@@ -673,6 +673,7 @@ static int fill_model_input_tf(TFModel *tf_model, TFRequestItem *request) {
         ret = AVERROR(ENOMEM);
         goto err;
     }
+    infer_request->nb_output = task->nb_output;

     for (int i = 0; i < task->nb_output; ++i) {
         infer_request->output_tensors[i] = NULL;