Skip to content

validate cascade node feature index before init#466

Open
metsw24-max wants to merge 1 commit into
ermig1979:masterfrom
metsw24-max:cascade-feature-index-bounds
Open

validate cascade node feature index before init#466
metsw24-max wants to merge 1 commit into
ermig1979:masterfrom
metsw24-max:cascade-feature-index-bounds

Conversation

@metsw24-max

Copy link
Copy Markdown
Contributor

Out-of-bounds feature index in cascade nodes

DetectionLoadStringXml parses untrusted cascade XML and stores each weak-classifier nodes featureIdxstraight from theinternalNodestext, with no range check. That index is later used to look a feature up:CreateHidHaarreadsdata.haarFeatures[node.featureIdx]during init, and the LBP predictor indexeshid.features[node->featureIdx]. A cascade whose node points past the parsed feature list (or a negative value) therefore reads off the end of the vector. With ASan a node index of 999999against a single feature faults atSimdBaseDetection.cpp:393inCreateHidHaar`.

The recently merged rect checks guarded the per-rect value vectors but not this node-to-feature reference, so it was still reachable. Validating the index once in the loader keeps the rejection at the parse boundary and covers both the HAAR and LBP paths. I have kept it to a range check raising the existing SIMD_EX; valid cascades are unaffected.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant