-
-
Notifications
You must be signed in to change notification settings - Fork 56.5k
Out of bound access in cap_mjpeg_encoder.cpp #19634
Copy link
Copy link
Closed
Labels
affected: 3.4bugcategory: imgcodecsconfirmedThere is stable reproducer / investigation completeThere is stable reproducer / investigation complete
Milestone
Description
Workaround: OpenCV 3.4.14: disabled parallel MJPEG encoder
System information (version)
- OpenCV => 3.2.0
- Operating System / Platform => Ubuntu 20.04
- Compiler => gcc 9.3.0
Detailed description
While using the cv::VideoWriter to write a MJPEG video, I sometimes get an error that causes an out of memory write/read in cap_mjpeg_encoder.cpp.
Tracking it down with valgrind, I got the following :
==27350== Thread 3:
==27350== Invalid write of size 4
==27350== at 0x586AA3D: get_data (cap_mjpeg_encoder.cpp:533)
==27350== by 0x586AA3D: cv::mjpeg::MotionJpegWriter::writeFrameData(unsigned char const*, int, int, int) (cap_mjpeg_encoder.cpp:1867)
==27350== by 0x586D5A9: cv::mjpeg::MotionJpegWriter::write(cv::_InputArray const&) (cap_mjpeg_encoder.cpp:843)
==27350== by 0x5866DD8: cv::VideoWriter::write(cv::Mat const&) (cap.cpp:776)
Looking at the code, there is even a warning :
//bits == 0 means that last element shouldn't be used.
m_output_buffer[m_data_len++] = currval;
And indeed, patching the code with :
//bits == 0 means that last element shouldn't be used.
if (bits != 0) m_output_buffer[m_data_len++] = currval;
I don't get the issue anymore.
Steps to reproduce
If needed, I could try to produce a MWE.
Issue submission checklist
- I report the issue, it's not a question
- I checked the problem with documentation, FAQ, open issues,
forum.opencv.org, Stack Overflow, etc and have not found solution - I updated to latest OpenCV version and the issue is still there
- There is reproducer code and related data files: videos, images, onnx, etc
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
affected: 3.4bugcategory: imgcodecsconfirmedThere is stable reproducer / investigation completeThere is stable reproducer / investigation complete