mirror/opencv
1
0
Fork 0
mirror of https://github.com/opencv/opencv.git synced 2024-11-28 21:20:18 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

Fixed the int size overflow bug of cv::Mat.push_back().

Browse Source 
Changed the type of variable *r* from int to size_t.
This change makes sure that a valid result of std::max(r + delta,
(r*3+1)/2) can be passed into the reserve function.
This commit is contained in:
miaow1988 2018-07-30 17:04:15 +08:00
parent 80cab4a163
commit 2988260107
1 changed files with 7 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
modules/core/src/matrix.cpp
View File

@ -602,13 +602,13 @@ void Mat::pop_back(size_t nelems)
void Mat::push_back_(const void* elem)
{
int r = size.p[0];
size_t r = size.p[0];
if( isSubmatrix() || dataend + step.p[0] > datalimit )
reserve( std::max(r + 1, (r*3+1)/2) );
size_t esz = elemSize();
memcpy(data + r*step.p[0], elem, esz);
size.p[0] = r + 1;
size.p[0] = int(r + 1);
dataend += step.p[0];
uint64 tsz = size.p[0];
for( int i = 1; i < dims; i++ )
@ -709,7 +709,8 @@ void Mat::resize(size_t nelems, const Scalar& s)
void Mat::push_back(const Mat& elems)
{
int r = size.p[0], delta = elems.size.p[0];
size_t r = size.p[0];
size_t delta = elems.size.p[0];
if( delta == 0 )
return;
if( this == &elems )
@ -726,7 +727,7 @@ void Mat::push_back(const Mat& elems)
size.p[0] = elems.size.p[0];
bool eq = size == elems.size;
size.p[0] = r;
size.p[0] = int(r);
if( !eq )
CV_Error(CV_StsUnmatchedSizes, "Pushed vector length is not equal to matrix row length");
if( type() != elems.type() )
@ -735,7 +736,7 @@ void Mat::push_back(const Mat& elems)
if( isSubmatrix() || dataend + step.p[0]*delta > datalimit )
reserve( std::max(r + delta, (r*3+1)/2) );
size.p[0] += delta;
size.p[0] += int(delta);
dataend += step.p[0]*delta;
//updateContinuityFlag(*this);
@ -744,7 +745,7 @@ void Mat::push_back(const Mat& elems)
memcpy(data + r*step.p[0], elems.data, elems.total()*elems.elemSize());
else
{
Mat part = rowRange(r, r + delta);
Mat part = rowRange(int(r), int(r + delta));
elems.copyTo(part);
}
}