Skip to content

OOB in opencv_test_ml #15561

@c0d3xpl0it

Description

@c0d3xpl0it

We found OOB in opencv_test_ml binary and OpenCV is complied with clang enabling ASAN.

Machine Setup

Machine : Ubuntu 16.04.3 LTS
OpenCV version: 4.1.2-pre
OpenCV VCS version: 4.1.1-267-ga74fe2e
Build type: Release
Compiler: /usr/bin/clang++  (ver 3.8.0)

Running the binary

fuzzer@fuzzer:~/victim/opencv_build/opencv/build/bin$ ./opencv_test_ml
CTEST_FULL_OUTPUT
OpenCV version: 4.1.2-pre
OpenCV VCS version: 4.1.1-267-ga74fe2e
Build type: Release
Compiler: /usr/bin/clang++  (ver 3.8.0)
Parallel framework: pthreads
CPU features: SSE SSE2 SSE3 *SSE4.1 *SSE4.2 *FP16 *AVX *AVX2
Intel(R) IPP version: ippIP AVX2 (l9) 2019.0.0 Gold (-) Jul 24 2018
OpenCL is disabled
TEST: Skip tests with tags: 'mem_6gb', 'verylong'
[==========] Running 44 tests from 16 test cases.
[----------] Global test environment set-up.
[----------] 8 tests from ML_SVMSGD
[ RUN      ] ML_SVMSGD.trainSameScale2
[       OK ] ML_SVMSGD.trainSameScale2 (1560 ms)
[ RUN      ] ML_SVMSGD.trainSameScale5

//SNIPPED//

[  FAILED  ] ML_LR.accuracy (1 ms)
[ RUN      ] ML_LR.save_load
ASAN:DEADLYSIGNAL
=================================================================
==13746==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x000000598068 bp 0x7ffc395c2670 sp 0x7ffc395c1680 T0)
    #0 0x598067  (/home/fuzzer/victim/opencv_build/opencv/build/bin/opencv_test_ml+0x598067)
    #1 0x67cb93  (/home/fuzzer/victim/opencv_build/opencv/build/bin/opencv_test_ml+0x67cb93)
    #2 0x59778e  (/home/fuzzer/victim/opencv_build/opencv/build/bin/opencv_test_ml+0x59778e)
    #3 0x597552  (/home/fuzzer/victim/opencv_build/opencv/build/bin/opencv_test_ml+0x597552)
    #4 0x6105c6  (/home/fuzzer/victim/opencv_build/opencv/build/bin/opencv_test_ml+0x6105c6)
    #5 0x610327  (/home/fuzzer/victim/opencv_build/opencv/build/bin/opencv_test_ml+0x610327)
    #6 0x613f17  (/home/fuzzer/victim/opencv_build/opencv/build/bin/opencv_test_ml+0x613f17)
    #7 0x615af9  (/home/fuzzer/victim/opencv_build/opencv/build/bin/opencv_test_ml+0x615af9)
    #8 0x63c8dc  (/home/fuzzer/victim/opencv_build/opencv/build/bin/opencv_test_ml+0x63c8dc)
    #9 0x63b5f6  (/home/fuzzer/victim/opencv_build/opencv/build/bin/opencv_test_ml+0x63b5f6)
    #10 0x63b0b6  (/home/fuzzer/victim/opencv_build/opencv/build/bin/opencv_test_ml+0x63b0b6)
    #11 0x5b6074  (/home/fuzzer/victim/opencv_build/opencv/build/bin/opencv_test_ml+0x5b6074)
    #12 0x7fe5f90f082f  (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #13 0x43eeb8  (/home/fuzzer/victim/opencv_build/opencv/build/bin/opencv_test_ml+0x43eeb8)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (/home/fuzzer/victim/opencv_build/opencv/build/bin/opencv_test_ml+0x598067)
==13746==ABORTING
fuzzer@fuzzer:~/victim/opencv_build/opencv/build/bin$

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions