Skip to content

Out of bound access in cap_mjpeg_encoder.cpp #19634

@nicolasmartin3d

Description

@nicolasmartin3d

Workaround: OpenCV 3.4.14: disabled parallel MJPEG encoder


System information (version)
  • OpenCV => 3.2.0
  • Operating System / Platform => Ubuntu 20.04
  • Compiler => gcc 9.3.0
Detailed description

While using the cv::VideoWriter to write a MJPEG video, I sometimes get an error that causes an out of memory write/read in cap_mjpeg_encoder.cpp.
Tracking it down with valgrind, I got the following :

==27350== Thread 3:
==27350== Invalid write of size 4
==27350==    at 0x586AA3D: get_data (cap_mjpeg_encoder.cpp:533)
==27350==    by 0x586AA3D: cv::mjpeg::MotionJpegWriter::writeFrameData(unsigned char const*, int, int, int) (cap_mjpeg_encoder.cpp:1867)
==27350==    by 0x586D5A9: cv::mjpeg::MotionJpegWriter::write(cv::_InputArray const&) (cap_mjpeg_encoder.cpp:843)
==27350==    by 0x5866DD8: cv::VideoWriter::write(cv::Mat const&) (cap.cpp:776)

Looking at the code, there is even a warning :

        //bits == 0 means that last element shouldn't be used.
        m_output_buffer[m_data_len++] = currval;

And indeed, patching the code with :

        //bits == 0 means that last element shouldn't be used.
        if (bits != 0) m_output_buffer[m_data_len++] = currval;

I don't get the issue anymore.

Steps to reproduce

If needed, I could try to produce a MWE.

Issue submission checklist
  • I report the issue, it's not a question
  • I checked the problem with documentation, FAQ, open issues,
    forum.opencv.org, Stack Overflow, etc and have not found solution
  • I updated to latest OpenCV version and the issue is still there
  • There is reproducer code and related data files: videos, images, onnx, etc

Metadata

Metadata

Assignees

Type

No type

Projects

No projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions