mirror of
https://github.com/opencv/opencv.git
synced 2026-09-11 04:43:22 -05:00
656f3395a7
videoio(mjpeg): fix heap-buffer-overflow in put_bits off-by-one resize guard #29113 ### Summary Fix a heap-buffer-overflow (WRITE of size 4) in the built-in MJPEG encoder detected by AddressSanitizer during fuzzing. Fixes #29112 ### Root Cause `mjpeg_buffer::put_bits` in `modules/videoio/src/cap_mjpeg_encoder.cpp` guards buffer resize with: ```cpp if ((m_pos == (data.size() - 1) && len > bits_free) || m_pos == data.size()) resize(int(2 * data.size())); ``` When `len == bits_free` the guard is **false** (strict `>`), so no resize happens. The subsequent code then: 1. Subtracts `len` from `bits_free`, making it exactly 0. 2. Enters the `bits_free <= 0` branch and executes `++m_pos`. 3. Writes `data[m_pos]` — now equal to `data[data.size()]` — **out of bounds**. ### Fix Change `len > bits_free` to `len >= bits_free` so the buffer is grown whenever the current slot will be exactly or more than consumed. ```diff -if ((m_pos == (data.size() - 1) && len > bits_free) || m_pos == data.size()) +if ((m_pos == (data.size() - 1) && len >= bits_free) || m_pos == data.size()) ``` ### Verification Reproducer (1×1 grayscale frame, `CAP_OPENCV_MJPEG`): ```cpp uint8_t pixel = 0xff; cv::Mat frame(1, 1, CV_8UC1, &pixel); int fourcc = cv::VideoWriter::fourcc('M', 'J', 'P', 'G'); cv::VideoWriter writer; writer.open("/tmp/poc.avi", cv::CAP_OPENCV_MJPEG, fourcc, 25.0, cv::Size(1,1), false); writer.write(frame); ``` Ran under `-fsanitize=address,undefined`; exits cleanly with no error after this fix. ### Regression Test `TEST(Videoio_MJPEG, put_bits_no_heap_overflow)` added to `modules/videoio/test/test_video_io.cpp` — opens a `CAP_OPENCV_MJPEG` VideoWriter for a 1×1 grayscale file and writes one frame; asserts `EXPECT_NO_THROW`.
OpenCV: Open Source Computer Vision Library
Resources
- Homepage: https://opencv.org
- Courses: https://opencv.org/courses
- Docs: https://docs.opencv.org/4.x/
- Q&A forum: https://forum.opencv.org
- previous forum (read only): http://answers.opencv.org
- Issue tracking: https://github.com/opencv/opencv/issues
- Additional OpenCV functionality: https://github.com/opencv/opencv_contrib
- Donate to OpenCV: https://opencv.org/support/
Contributing
Please read the contribution guidelines before starting work on a pull request.
Summary of the guidelines:
- One pull request per issue;
- Choose the right base branch;
- Include tests and documentation;
- Clean up "oops" commits before submitting;
- Follow the coding style guide.
Additional Resources
- Submit your OpenCV-based project for inclusion in Community Friday on opencv.org
- Subscribe to the OpenCV YouTube Channel featuring OpenCV Live, an hour-long streaming show
- Follow OpenCV on LinkedIn for daily posts showing the state-of-the-art in computer vision & AI
- Apply to be an OpenCV Volunteer to help organize events and online campaigns as well as amplify them
- Follow OpenCV on Mastodon in the Fediverse
- Follow OpenCV on Twitter
- OpenCV.ai: Computer Vision and AI development services from the OpenCV team.