Skip to content

xfeatures2d: fix out-of-bounds read in PCTSignaturesSQFD::computeQuadraticFormDistances#4173

Open
shimat wants to merge 1 commit into
opencv:5.xfrom
shimat:fix/pctsignaturessqfd-oob-read
Open

xfeatures2d: fix out-of-bounds read in PCTSignaturesSQFD::computeQuadraticFormDistances#4173
shimat wants to merge 1 commit into
opencv:5.xfrom
shimat:fix/pctsignaturessqfd-oob-read

Conversation

@shimat

@shimat shimat commented Jul 10, 2026

Copy link
Copy Markdown
Contributor

Parallel_computeSQFDs::operator() in pct_signatures_sqfd.cpp indexes mImageSignatures (a const std::vector<Mat>*) as mImageSignatures[i] instead of (*mImageSignatures)[i]. This happens to work for i == 0, but for i >= 1 it reads past the pointed-to vector as unallocated memory, which is undefined behavior and in practice throws a spurious Signature ID: N is empty! once imageSignatures has 2 or more elements.

Added a regression test in test_pct_signatures_sqfd.cpp that calls computeQuadraticFormDistances with 3 signatures and checks each result against a direct computeQuadraticFormDistance call.

Pull Request Readiness Checklist

See details at https://github.com/opencv/opencv/wiki/How_to_contribute#making-a-good-pull-request

  • I agree to contribute to the project under Apache 2 License.
  • To the best of my knowledge, the proposed patch is not based on a code under GPL or another license that is incompatible with OpenCV
  • The PR is proposed to the proper branch
  • There is a reference to the original bug report and related work
  • There is accuracy test, performance test and test data in opencv_extra repository, if applicable
    Patch to opencv_extra has the same branch name.
  • The feature is well documented and sample code can be built with the project CMake

…raticFormDistances

Parallel_computeSQFDs::operator() indexed mImageSignatures (a pointer to
a std::vector<Mat>) as mImageSignatures[i] instead of dereferencing the
vector first, i.e. (*mImageSignatures)[i]. This happened to work for
i == 0 (mImageSignatures[0] is equivalent to *mImageSignatures), but for
i >= 1 it read past the pointed-to vector as unallocated memory,
producing undefined behavior (typically a spurious "Signature ID: N is
empty!" exception once imageSignatures has 2 or more elements).
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant