liuliu/ccv — Issue #6: Memory access out of allocated range
Author: Corion
Created: 2012-02-11 20:54:31+00:00
State: open

On Windows XP using gcc (GCC) 4.4.3 32-bit, I get segfaults when running

siftmatch.exe ..\samples\scene.png ..\samples\book.png

These segfaults happen, because in ccv_sift(), the access to the bf, cf and uf pointers sometimes goes before the allocated area, whenever

offset = ix + (iy - y) * cols

becomes more negative than bf etc. have been incremented.

No such crash happens on Linux 32-bit with gcc 4.3.2, but I suspect that the out of bounds memory access just isn't fatal there.

I have "fixed" this by adding a guarding statement at the start of the converging loop:

/* iteratively converge to meet subpixel accuracy */
for (k = 0; k < 5; k++)
{
offset = ix + (iy - y) * cols;
if( sentinel_bf + offset < 0
|| sentinel_cf + offset < 0
|| sentinel_uf + offset < 0) {
printf("In3 (k=%i, offset=%i, ix=%i, iy=%i, y=%i, cols=%i)\n",k, offset, ix, iy, y, cols);
printf("cf at %08x, accessing %08x (%i bytes before)\n", (int)cf, &cf[offset-cols-1], (offset-cols-1)*sizeof(*cf));
cvg = -1;
break;
};

With that change, the code runs through on Windows and gives the same results as on Linux. I am not sure if that change is sane, or if the problems are just symptoms of other stuff that is happening.

If you are interested in that change (and some other small, include file related changes) for Windows, I'll fork the repo and create a pull request.

-max