mirror of
https://github.com/opencv/opencv.git
synced 2026-07-29 07:13:02 +04:00
Udit Jain
c8446af29a
In HOGCache::init the block gaussian weights are computed into two buffers: AutoBuffer<float> di(blockSize.height), dj(blockSize.width); The vectorized (CV_SIMD128) loop that fills dj was bounded by `blockSize.height` instead of `blockSize.width`. When the block is taller than it is wide, `v_store(_dj + j, ...)` writes past the end of the width-sized dj buffer, causing a heap buffer overflow / access violation (e.g. HOGDescriptor with a 198x281 window, or the 2399x2400 case from the report). Bound the dj loop by `blockSize.width` to match the buffer size and the scalar tail loop. This keeps the SIMD path (unlike the workaround in the report, which disabled it). Added a regression test that computes a HOGDescriptor with a tall block; without the fix it triggers a heap-buffer-overflow (confirmed with AddressSanitizer at hog.cpp:731 inside HOGCache::init). Fixes #23580