Skip to content

Fix UB in CopyMakeConstBoder_8u#19603

Merged
opencv-pushbot merged 1 commit intoopencv:3.4from
federicohml:fix-ub-copy-make-const-border-8u
Feb 27, 2021
Merged

Fix UB in CopyMakeConstBoder_8u#19603
opencv-pushbot merged 1 commit intoopencv:3.4from
federicohml:fix-ub-copy-make-const-border-8u

Conversation

@federicohml
Copy link
Copy Markdown

@federicohml federicohml commented Feb 23, 2021

Problem: addition of unsigned offset to 0x000007ff0362 overflowed to 0x000007fefac0

In third_party/opencv/modules/core/src/copy.cpp the function copyMakeConstBorder_8u receives the step of a cv::Mat, namely dststep of type size_t. When offsetting the destination matrix pointer to start copying data, memcpy(dst + (i - top) * dststep, constBuf, dstroi.width) the result of (i - top) could be negative, then, when applying the arithmetic operator * because of arithmetic operator conversion the int is converted to size_t, resulting pointer overflow.

Pull Request Readiness Checklist

See details at https://github.com/opencv/opencv/wiki/How_to_contribute#making-a-good-pull-request

  • I agree to contribute to the project under Apache 2 License.
  • To the best of my knowledge, the proposed patch is not based on a code under GPL or other license that is incompatible with OpenCV
  • The PR is proposed to proper branch
  • There is reference to original bug report and related work
  • There is accuracy test, performance test and test data in opencv_extra repository, if applicable
    Patch to opencv_extra has the same branch name.
  • The feature is well documented and sample code can be built with the project CMake

@federicohml
Copy link
Copy Markdown
Author

Could you elaborate on There is reference to original bug report and related work, what does that mean?

Comment on lines 1330 to 1334
for( i = 0; i < top; i++ )
memcpy(dst + (i - top)*dststep, constBuf, dstroi.width);
memcpy(dst + (i - top)*static_cast<int>(dststep), constBuf, dstroi.width);

for( i = 0; i < bottom; i++ )
memcpy(dst + (i + srcroi.height)*dststep, constBuf, dstroi.width);
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please add problem description.

Are you sure that this patch fixes your problem? Because there is another similar code few lines below.

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I added a more detailed description of the problem I found.
I am sure it fixed the UB I found. This is the only part I am using so far in my code so I cannot tell whether there are/aren't more UB similar to this one, but at least this one is fixed. I will be more than happy to fix other as I cross them my way, though.

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I added a more detailed description of the problem.

I am sure it fixed the UB I found. This is the only part I am using so far in my code so I cannot tell whether there are/aren't more UB similar to this one, but at least this one is fixed. I will be more than happy to fix other as I cross them my way, though.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The fix will fail if dststep is greater than INT_MAX. That's not the most often case, but possible.
Also i-top is always negative so the fix could be dst - (top - i)*dststep

Caused by overflow of arithmetic operators conversion rank
@alalek
Copy link
Copy Markdown
Member

alalek commented Feb 26, 2021

Patch is rebased on 3.4 branch and updated to avoid using of pointers arithmetic with negative offsets.

@federicohml Please take a look (we do no have reproducer on our side).

@opencv-pushbot opencv-pushbot merged commit 19f1bac into opencv:3.4 Feb 27, 2021
@alalek alalek mentioned this pull request Feb 27, 2021
@alalek alalek mentioned this pull request Apr 9, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants