Skip to content

Commit 8561f45

Browse files
vrabaudvrabaud
authored
Merge pull request opencv#26084 from vrabaud:avif_check
Avoid uninitialized value read in resize. opencv#26084 When there is no point falling right, an hypothetical value is computed (but unused) using an uninitialized ofst. This triggers warnings in the sanitizers. Including those values in the for loops is also possible but messy when SIMD is involved. ### Pull Request Readiness Checklist See details at https://github.com/opencv/opencv/wiki/How_to_contribute#making-a-good-pull-request - [x] I agree to contribute to the project under Apache 2 License. - [x] To the best of my knowledge, the proposed patch is not based on a code under GPL or another license that is incompatible with OpenCV - [x] The PR is proposed to the proper branch
1 parent 88f99ed commit 8561f45

File tree

1 file changed

+56
-0
lines changed

1 file changed

+56
-0
lines changed

‎modules/imgproc/src/resize.cpp‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -95,6 +95,10 @@ static void hlineResize(ET* src, int cn, int *ofst, FT* m, FT* dst, int dst_min,
9595
}
9696
}
9797
}
98+
// Avoid reading a potentially unset ofst, leading to a random memory read.
99+
if (i >= dst_width) {
100+
return;
101+
}
98102
ET* src_last = src + cn*ofst[dst_width - 1];
99103
for (; i < dst_width; i++) // Points that fall right from src image so became equal to rightmost src point
100104
{
@@ -126,6 +130,10 @@ template <typename ET, typename FT> struct hline<ET, FT, 2, true, 1>
126130
ET* px = src + ofst[i];
127131
*(dst++) = m[0] * px[0] + m[1] * px[1];
128132
}
133+
// Avoid reading a potentially unset ofst, leading to a random memory read.
134+
if (i >= dst_width) {
135+
return;
136+
}
129137
src0 = (src + ofst[dst_width - 1])[0];
130138
for (; i < dst_width; i++) // Points that fall right from src image so became equal to rightmost src point
131139
{
@@ -150,6 +158,10 @@ template <typename ET, typename FT> struct hline<ET, FT, 2, true, 2>
150158
*(dst++) = m[0] * px[0] + m[1] * px[2];
151159
*(dst++) = m[0] * px[1] + m[1] * px[3];
152160
}
161+
// Avoid reading a potentially unset ofst, leading to a random memory read.
162+
if (i >= dst_width) {
163+
return;
164+
}
153165
src0 = (src + 2*ofst[dst_width - 1])[0];
154166
src1 = (src + 2*ofst[dst_width - 1])[1];
155167
for (; i < dst_width; i++) // Points that fall right from src image so became equal to rightmost src point
@@ -178,6 +190,10 @@ template <typename ET, typename FT> struct hline<ET, FT, 2, true, 3>
178190
*(dst++) = m[0] * px[1] + m[1] * px[4];
179191
*(dst++) = m[0] * px[2] + m[1] * px[5];
180192
}
193+
// Avoid reading a potentially unset ofst, leading to a random memory read.
194+
if (i >= dst_width) {
195+
return;
196+
}
181197
src0 = (src + 3*ofst[dst_width - 1])[0];
182198
src1 = (src + 3*ofst[dst_width - 1])[1];
183199
src2 = (src + 3*ofst[dst_width - 1])[2];
@@ -210,6 +226,10 @@ template <typename ET, typename FT> struct hline<ET, FT, 2, true, 4>
210226
*(dst++) = m[0] * px[2] + m[1] * px[6];
211227
*(dst++) = m[0] * px[3] + m[1] * px[7];
212228
}
229+
// Avoid reading a potentially unset ofst, leading to a random memory read.
230+
if (i >= dst_width) {
231+
return;
232+
}
213233
src0 = (src + 4*ofst[dst_width - 1])[0];
214234
src1 = (src + 4*ofst[dst_width - 1])[1];
215235
src2 = (src + 4*ofst[dst_width - 1])[2];
@@ -238,6 +258,10 @@ template <typename ET, typename FT> struct hline<ET, FT, 4, true, 1>
238258
ET* px = src + ofst[i];
239259
*(dst++) = m[0] * src[0] + m[1] * src[1] + m[2] * src[2] + m[3] * src[3];
240260
}
261+
// Avoid reading a potentially unset ofst, leading to a random memory read.
262+
if (i >= dst_width) {
263+
return;
264+
}
241265
src0 = (src + ofst[dst_width - 1])[0];
242266
for (; i < dst_width; i++) // Points that fall right from src image so became equal to rightmost src point
243267
{
@@ -262,6 +286,10 @@ template <typename ET, typename FT> struct hline<ET, FT, 4, true, 2>
262286
*(dst++) = m[0] * src[0] + m[1] * src[2] + m[2] * src[4] + m[3] * src[6];
263287
*(dst++) = m[0] * src[1] + m[1] * src[3] + m[2] * src[5] + m[3] * src[7];
264288
}
289+
// Avoid reading a potentially unset ofst, leading to a random memory read.
290+
if (i >= dst_width) {
291+
return;
292+
}
265293
src0 = (src + 2*ofst[dst_width - 1])[0];
266294
src1 = (src + 2*ofst[dst_width - 1])[1];
267295
for (; i < dst_width; i++) // Points that fall right from src image so became equal to rightmost src point
@@ -290,6 +318,10 @@ template <typename ET, typename FT> struct hline<ET, FT, 4, true, 3>
290318
*(dst++) = m[0] * src[1] + m[1] * src[4] + m[2] * src[7] + m[3] * src[10];
291319
*(dst++) = m[0] * src[2] + m[1] * src[5] + m[2] * src[8] + m[3] * src[11];
292320
}
321+
// Avoid reading a potentially unset ofst, leading to a random memory read.
322+
if (i >= dst_width) {
323+
return;
324+
}
293325
src0 = (src + 3*ofst[dst_width - 1])[0];
294326
src1 = (src + 3*ofst[dst_width - 1])[1];
295327
src2 = (src + 3*ofst[dst_width - 1])[2];
@@ -322,6 +354,10 @@ template <typename ET, typename FT> struct hline<ET, FT, 4, true, 4>
322354
*(dst++) = m[0] * src[2] + m[1] * src[6] + m[2] * src[10] + m[3] * src[14];
323355
*(dst++) = m[0] * src[3] + m[1] * src[7] + m[2] * src[11] + m[3] * src[15];
324356
}
357+
// Avoid reading a potentially unset ofst, leading to a random memory read.
358+
if (i >= dst_width) {
359+
return;
360+
}
325361
src0 = (src + 4*ofst[dst_width - 1])[0];
326362
src1 = (src + 4*ofst[dst_width - 1])[1];
327363
src2 = (src + 4*ofst[dst_width - 1])[2];
@@ -383,6 +419,10 @@ void hlineResizeCn<uint8_t, ufixedpoint16, 2, true, 1>(uint8_t* src, int, int *o
383419
uint8_t* px = src + ofst[i];
384420
*(dst++) = m[0] * px[0] + m[1] * px[1];
385421
}
422+
// Avoid reading a potentially unset ofst, leading to a random memory read.
423+
if (i >= dst_width) {
424+
return;
425+
}
386426
src_0 = (src + ofst[dst_width - 1])[0];
387427
#if (CV_SIMD || CV_SIMD_SCALABLE)
388428
v_src_0 = vx_setall_u16(*((uint16_t*)&src_0));
@@ -439,6 +479,10 @@ void hlineResizeCn<uint8_t, ufixedpoint16, 2, true, 2>(uint8_t* src, int, int *o
439479
*(dst++) = m[0] * px[0] + m[1] * px[2];
440480
*(dst++) = m[0] * px[1] + m[1] * px[3];
441481
}
482+
// Avoid reading a potentially unset ofst, leading to a random memory read.
483+
if (i >= dst_width) {
484+
return;
485+
}
442486
((ufixedpoint16*)(srccn.w))[0] = (src + 2 * ofst[dst_width - 1])[0]; ((ufixedpoint16*)(srccn.w))[1] = (src + 2 * ofst[dst_width - 1])[1];
443487
#if (CV_SIMD || CV_SIMD_SCALABLE)
444488
v_srccn = v_reinterpret_as_u16(vx_setall_u32(srccn.d));
@@ -511,6 +555,10 @@ void hlineResizeCn<uint8_t, ufixedpoint16, 2, true, 3>(uint8_t* src, int, int *o
511555
*(dst++) = m[0] * px[1] + m[1] * px[4];
512556
*(dst++) = m[0] * px[2] + m[1] * px[5];
513557
}
558+
// Avoid reading a potentially unset ofst, leading to a random memory read.
559+
if (i >= dst_width) {
560+
return;
561+
}
514562
((ufixedpoint16*)(srccn.w))[0] = (src + 3*ofst[dst_width - 1])[0];
515563
((ufixedpoint16*)(srccn.w))[1] = (src + 3*ofst[dst_width - 1])[1];
516564
((ufixedpoint16*)(srccn.w))[2] = (src + 3*ofst[dst_width - 1])[2];
@@ -584,6 +632,10 @@ void hlineResizeCn<uint8_t, ufixedpoint16, 2, true, 4>(uint8_t* src, int, int *o
584632
*(dst++) = m[0] * px[2] + m[1] * px[6];
585633
*(dst++) = m[0] * px[3] + m[1] * px[7];
586634
}
635+
// Avoid reading a potentially unset ofst, leading to a random memory read.
636+
if (i >= dst_width) {
637+
return;
638+
}
587639
((ufixedpoint16*)(srccn.w))[0] = (src + 4 * ofst[dst_width - 1])[0]; ((ufixedpoint16*)(srccn.w))[1] = (src + 4 * ofst[dst_width - 1])[1];
588640
((ufixedpoint16*)(srccn.w))[2] = (src + 4 * ofst[dst_width - 1])[2]; ((ufixedpoint16*)(srccn.w))[3] = (src + 4 * ofst[dst_width - 1])[3];
589641
#if (CV_SIMD || CV_SIMD_SCALABLE)
@@ -635,6 +687,10 @@ void hlineResizeCn<uint16_t, ufixedpoint32, 2, true, 1>(uint16_t* src, int, int
635687
uint16_t* px = src + ofst[i];
636688
*(dst++) = m[0] * px[0] + m[1] * px[1];
637689
}
690+
// Avoid reading a potentially unset ofst, leading to a random memory read.
691+
if (i >= dst_width) {
692+
return;
693+
}
638694
src_0 = (src + ofst[dst_width - 1])[0];
639695
#if (CV_SIMD || CV_SIMD_SCALABLE)
640696
v_src_0 = vx_setall_u32(*((uint32_t*)&src_0));

0 commit comments

Comments
 (0)