mirror of
https://github.com/opencv/opencv.git
synced 2026-09-11 04:43:22 -05:00
9b1aa94e69
features2d: fix heap buffer overflow in AKAZE generateDescriptorSubsample #29623 Prevent out-of-bounds write in `generateDescriptorSubsample()` during AKAZE MLDB descriptor generation when `nchannels < 3` (e.g. `nchannels = 2`). Fixes #29613 ### Summary of Changes - **Module:** `features2d` (AKAZE) - **Problem:** When `generateDescriptorSubsample()` is called with `nchannels < 3`, the code hardcoded 3-channel matrix index offsets (`+ 0`, `+ 1`, `+ 2`). Since `comps` allocates rows based on `nchannels * npicks`, writing to index offset `+ 2` when `nchannels = 2` causes a heap buffer overflow past the last row of `comps`. - **Fix:** Replaced hardcoded 3-channel matrix index assignments with a dynamic loop that iterates over `0` to `nchannels - 1`. - **Regression Test:** Added `Features2D_AKAZE.Subsample_Channels_Overflow_Fix` in `modules/features2d/test/test_akaze.cpp`. - ### Acknowledgments Thanks to @abhishek-gola for reviewing the test and suggesting the correct approach. ### Pull Request Readiness Checklist See details at https://github.com/opencv/opencv/wiki/How_to_contribute#making-a-good-pull-request - [x] I agree to contribute to the project under Apache 2 License. - [x] To the best of my knowledge, the proposed patch is not based on a code under GPL or another license that is incompatible with OpenCV - [x] The PR is proposed to the proper branch (`4.x`) - [x] There is a reference to the original bug report and related work - [x] There is accuracy test, performance test and test data in opencv_extra repository, if applicable Patch to opencv_extra has the same branch name. - [x] The feature is well documented and sample code can be built with the project CMake