From a37201abee79fa8c23da92b0d65a62e3dab65add Mon Sep 17 00:00:00 2001 From: arnaudbrejeon Date: Tue, 2 Jul 2019 09:56:31 -0700 Subject: [PATCH] Fix crash, add assert and test --- modules/imgproc/src/connectedcomponents.cpp | 4 +++- modules/imgproc/test/test_connectedcomponents.cpp | 14 ++++++++++++++ 2 files changed, 17 insertions(+), 1 deletion(-) diff --git a/modules/imgproc/src/connectedcomponents.cpp b/modules/imgproc/src/connectedcomponents.cpp index 10095842b2..9241c6c09e 100644 --- a/modules/imgproc/src/connectedcomponents.cpp +++ b/modules/imgproc/src/connectedcomponents.cpp @@ -2542,7 +2542,8 @@ namespace cv{ //Array used to store info and labeled pixel by each thread. //Different threads affect different memory location of chunksSizeAndLabels - int *chunksSizeAndLabels = (int *)cv::fastMalloc(h * sizeof(int)); + const int chunksSizeAndLabelsSize = h + 1; + int *chunksSizeAndLabels = (int *)cv::fastMalloc(chunksSizeAndLabelsSize * sizeof(int)); //Tree of labels LabelT *P = (LabelT *)cv::fastMalloc(Plength * sizeof(LabelT)); @@ -2561,6 +2562,7 @@ namespace cv{ LabelT nLabels = 1; for (int i = 0; i < h; i = chunksSizeAndLabels[i]){ + CV_Assert(i + 1 < chunksSizeAndLabelsSize); flattenL(P, LabelT((i + 1) / 2) * LabelT((w + 1) / 2) + 1, chunksSizeAndLabels[i + 1], nLabels); } diff --git a/modules/imgproc/test/test_connectedcomponents.cpp b/modules/imgproc/test/test_connectedcomponents.cpp index abd6fd43b4..3817f6d172 100644 --- a/modules/imgproc/test/test_connectedcomponents.cpp +++ b/modules/imgproc/test/test_connectedcomponents.cpp @@ -136,4 +136,18 @@ void CV_ConnectedComponentsTest::run( int /* start_from */) TEST(Imgproc_ConnectedComponents, regression) { CV_ConnectedComponentsTest test; test.safe_run(); } +TEST(Imgproc_ConnectedComponents, grana_buffer_overflow) +{ + cv::Mat darkMask; + darkMask.create(31, 87, CV_8U); + darkMask = 0; + + cv::Mat labels; + cv::Mat stats; + cv::Mat centroids; + + int nbComponents = cv::connectedComponentsWithStats(darkMask, labels, stats, centroids, 8, CV_32S, cv::CCL_GRANA); + EXPECT_EQ(1, nbComponents); +} + }} // namespace