Fixes #28396 : out-of-bounds read in SIMD type conversion#28397
Merged
asmorkalov merged 5 commits intoopencv:4.xfrom Mar 27, 2026
Merged
Fixes #28396 : out-of-bounds read in SIMD type conversion#28397asmorkalov merged 5 commits intoopencv:4.xfrom
asmorkalov merged 5 commits intoopencv:4.xfrom
Conversation
akretz
reviewed
Jan 14, 2026
Contributor
akretz
left a comment
There was a problem hiding this comment.
This seems to be the correct approach to fix the linked issue to me. Some observations:
- You need the backslashes at the end of the lines, otherwise the macro breaks.
- Don't you need to make the
tmparray hold elements of type_Tpwvec::lane_typeand then remove the call tointrin()? That's how it's done in the float16 implementation ofv_load_expand. Because now thewasm_v128_load()reads over the end of the array. v_load_expand_qhas the same bug that it reads too much data, right? In that case, a similar fix has to be applied there.
Contributor
Author
|
Switched the temp buffer to _Tpwvec::lane_type and load directly into the vector, consistent with the float16 implementation. This guarantees safe 128-bit loads on WASM and resolves the ASAN OOB. Also fixed macro formatting and applied the same fix to v_load_expand_q. |
Contributor
Author
|
@asmorkalov reminder that this is pending review. Let me know if I should address any changes. |
asmorkalov
approved these changes
Feb 13, 2026
44b9351 to
aef1692
Compare
Contributor
|
Rebased on top of 4.x to re-trigger CI. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #28396
Fixes #27080
The vx_load_expand function in WASM intrinsics was using
wasm_v128_load which always loads a full 128-bit register
(16 bytes), even when the function only needed 8 elements.
For example, when converting uint8 to float32:
Pull Request Readiness Checklist
See details at https://github.com/opencv/opencv/wiki/How_to_contribute#making-a-good-pull-request
Patch to opencv_extra has the same branch name.