Skip to content

Fix vector access in TF::sortByExecutionOrder#22006

Merged
opencv-pushbot merged 1 commit intoopencv:3.4from
rogday:21947_fix
May 24, 2022
Merged

Fix vector access in TF::sortByExecutionOrder#22006
opencv-pushbot merged 1 commit intoopencv:3.4from
rogday:21947_fix

Conversation

@rogday
Copy link
Copy Markdown
Member

@rogday rogday commented May 18, 2022

Merge with extra: opencv/opencv_extra#974
Fixes #21947

Pull Request Readiness Checklist

See details at https://github.com/opencv/opencv/wiki/How_to_contribute#making-a-good-pull-request

  • I agree to contribute to the project under Apache 2 License.
  • To the best of my knowledge, the proposed patch is not based on a code under GPL or another license that is incompatible with OpenCV
  • The PR is proposed to the proper branch
  • There is a reference to the original bug report and related work
  • There is accuracy test, performance test and test data in opencv_extra repository, if applicable
    Patch to opencv_extra has the same branch name.
  • The feature is well documented and sample code can be built with the project CMake

}
else
numRefsToAdd[i] = numInputsInGraph;
numRefsToAdd.at(i) = numInputsInGraph;
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

.at() emits on error:

C++ exception with description "vector::_M_range_check: __n (which is 10) >= this->size() (which is 1)" thrown in the test body.

OpenCV check (before if (node.op() == "Merge" ...)

CV_CheckLT((size_t)i, numRefsToAdd.size(), "");

could emit message with line number from OpenCV codebase.

C++ exception with description "OpenCV(3.4.17-dev) modules/dnn/src/tensorflow/tf_graph_simplifier.cpp:1018: error: (-2:Unspecified error) in function 'void cv::dnn::experimental_dnn_34_v24::sortByExecutionOrder(opencv_tensorflow::GraphDef&)'
>  (expected: '(size_t)i < numRefsToAdd.size()'), where
>     '(size_t)i' is 10
> must be less than
>     'numRefsToAdd.size()' is 1
" thrown in the test body.

If user comes with report with the first message only then it would be bad for problem investigation (we need to start from beginning and ask for debugger and its call trace to confirm the problem).

.at() is harmless in importer code (until we have problems with importer performance), but IMHO, it is for lazy developers who don't add code for validation of input.


BTW, ENABLE_GNU_STL_DEBUG / _GLIBCXX_DEBUG (which enables debug checks including [i] case) causes crashes inside of protobuf code. Perhaps something is broken (e.g. modifying of protobuf nodes)


Accurate check looks like
CV_CheckEQ(nodesMap.size(), (size_t)net.node_size(), "node names must be unique");
after the first for loop (line 992).

Copy link
Copy Markdown
Member

@alalek alalek left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you 👍

@opencv-pushbot opencv-pushbot merged commit 978dc76 into opencv:3.4 May 24, 2022
@rogday rogday deleted the 21947_fix branch May 24, 2022 20:00
@alalek alalek mentioned this pull request Jun 4, 2022
@alalek alalek mentioned this pull request Aug 21, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

BufferOverflow BugReport, Fuzzing suggestion

3 participants