mirror of
https://github.com/opencv/opencv.git
synced 2026-07-25 05:13:04 +04:00
Yixuan Tang
656f3395a7
videoio(mjpeg): fix heap-buffer-overflow in put_bits off-by-one resize guard #29113 ### Summary Fix a heap-buffer-overflow (WRITE of size 4) in the built-in MJPEG encoder detected by AddressSanitizer during fuzzing. Fixes #29112 ### Root Cause `mjpeg_buffer::put_bits` in `modules/videoio/src/cap_mjpeg_encoder.cpp` guards buffer resize with: ```cpp if ((m_pos == (data.size() - 1) && len > bits_free) || m_pos == data.size()) resize(int(2 * data.size())); ``` When `len == bits_free` the guard is **false** (strict `>`), so no resize happens. The subsequent code then: 1. Subtracts `len` from `bits_free`, making it exactly 0. 2. Enters the `bits_free <= 0` branch and executes `++m_pos`. 3. Writes `data[m_pos]` — now equal to `data[data.size()]` — **out of bounds**. ### Fix Change `len > bits_free` to `len >= bits_free` so the buffer is grown whenever the current slot will be exactly or more than consumed. ```diff -if ((m_pos == (data.size() - 1) && len > bits_free) || m_pos == data.size()) +if ((m_pos == (data.size() - 1) && len >= bits_free) || m_pos == data.size()) ``` ### Verification Reproducer (1×1 grayscale frame, `CAP_OPENCV_MJPEG`): ```cpp uint8_t pixel = 0xff; cv::Mat frame(1, 1, CV_8UC1, &pixel); int fourcc = cv::VideoWriter::fourcc('M', 'J', 'P', 'G'); cv::VideoWriter writer; writer.open("/tmp/poc.avi", cv::CAP_OPENCV_MJPEG, fourcc, 25.0, cv::Size(1,1), false); writer.write(frame); ``` Ran under `-fsanitize=address,undefined`; exits cleanly with no error after this fix. ### Regression Test `TEST(Videoio_MJPEG, put_bits_no_heap_overflow)` added to `modules/videoio/test/test_video_io.cpp` — opens a `CAP_OPENCV_MJPEG` VideoWriter for a 1×1 grayscale file and writes one frame; asserts `EXPECT_NO_THROW`.