bugGNU Octave - Bugs: bug #66918, (image) "test...

 
 

bug #66918: (image) "test bwlabeln.cc-tst" causes heap-buffer-overflow crash.

Submitter:  Dmitri A. Sergatskov <dasergatskov>
Submitted:  Sun 16 Mar 2025 12:06:36 AM UTC
   
 
Category:  Octave Package Severity:  3 - Normal
Priority:  5 - Normal Item Group:  Segfault, Bus Error, etc.
Status:  Fixed Assigned to:  None
Originator Name:  Open/Closed:  * Closed
Release:  * 10.0.90 Release: 
Operating System:  * GNU/Linux Fixed Release:  None
Planned Release:  None
* Mandatory Fields

Add a New Comment Rich Markup
   

Sun 23 Mar 2025 06:07:42 AM UTC, comment #3: 


Thanks for the quick fix.
It was pushed here:
https://sourceforge.net/p/octave/image/ci/a12900ac1c3b3e930aae492fd9552bd3c00c2020/

Closing this report

Avinoam Kalma <avinoam>
Group Member
Sun 16 Mar 2025 03:59:21 PM UTC, comment #2: 

The fix appears to be 'easy":

diff -r 9103b586197c src/connectivity.cc
--- a/src/connectivity.cc       Tue Mar 04 21:53:20 2025 +0200
+++ b/src/connectivity.cc       Sun Mar 16 11:56:15 2025 -0400
@@ -149,6 +149,10 @@
   const octave_idx_type ndims = connectivity::ndims (mask);
   const octave_idx_type numel = mask.numel ();

+  // If ndims is 0 or numel is 0, return an empty array
+  if (ndims <= 0 || numel <= 0)
+    return Array<octave_idx_type> (dim_vector (0, 1));
+
   // offset to adjacent element on correspoding dimension
   Array<octave_idx_type> strides (dim_vector (ndims, 1));
   strides(0) = 1;


but may be the issue is deeper and I am missing something. With this patch "pkg test image" passes:

Summary:

  PASS                             2211
  FAIL                                0
  XFAIL (expected failure)           35


Dmitri.
--

Dmitri A. Sergatskov <dasergatskov>
Sun 16 Mar 2025 12:16:39 AM UTC, comment #1: 

Repeat with `octave-cli` so no QThread and trace a little simpler.

=================================================================
==229073==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x5020005f4430 at pc 0x7ff0bafc0234 bp 0x7ffe30ac0810 sp 0x7ffe30ac0808
WRITE of size 8 at 0x5020005f4430 thread T0
    #0 0x7ff0bafc0233 in octave_image_pkg::connectivity::neighbourhood(dim_vector const&) const /tmp/oct-Eyoziy/image-2.17.0+/src/connectivity.cc:154:14
    #1 0x7ff0bafc1999 in octave_image_pkg::connectivity::negative_neighbourhood(dim_vector const&) const /tmp/oct-Eyoziy/image-2.17.0+/src/connectivity.cc:233:36
    #2 0x7ff0bafcf85f in pre_label(NDArray&, octave_image_pkg::connectivity const&) /tmp/oct-Eyoziy/image-2.17.0+/src/bwlabeln.cc:42:12
    #3 0x7ff0bafcf258 in bwlabel_nd(boolNDArray const&, octave_image_pkg::connectivity const&) /tmp/oct-Eyoziy/image-2.17.0+/src/bwlabeln.cc:107:20
    #4 0x7ff0bafcd116 in Fbwlabeln(octave_value_list const&, int) /tmp/oct-Eyoziy/image-2.17.0+/src/bwlabeln.cc:395:12
    #5 0x7ff0c3110c4b in octave::tree_evaluator::execute_builtin_function(octave_builtin&, int, octave_value_list const&) /home/dmitri/src/octave/clang_asan/../libinterp/parse-tree/pt-eval.cc:3551:14
...


Full trace is attached ("image_ASAN_crash_2.txt.gz")

Dmitri.
--


(file #57026)

Dmitri A. Sergatskov <dasergatskov>
Sun 16 Mar 2025 12:06:36 AM UTC, original submission:  

Doing "test bwlabeln.cc-tst" with image-2.16 (or current image-2.17.0+) on octave compiled with ASAN I see a crash:

==226584==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x5020039a60f0 at pc 0x7f4cde715234 bp 0x7ffe86259ed0 sp 0x7ffe86259ec8
WRITE of size 8 at 0x5020039a60f0 thread T0
    #0 0x7f4cde715233 in octave_image_pkg::connectivity::neighbourhood(dim_vector const&) const /tmp/oct-Eyoziy/image-2.17.0+/src/connectivity.cc:154:14
    #1 0x7f4cde716999 in octave_image_pkg::connectivity::negative_neighbourhood(dim_vector const&) const /tmp/oct-Eyoziy/image-2.17.0+/src/connectivity.cc:233:36
    #2 0x7f4cde72485f in pre_label(NDArray&, octave_image_pkg::connectivity const&) /tmp/oct-Eyoziy/image-2.17.0+/src/bwlabeln.cc:42:12
    #3 0x7f4cde724258 in bwlabel_nd(boolNDArray const&, octave_image_pkg::connectivity const&) /tmp/oct-Eyoziy/image-2.17.0+/src/bwlabeln.cc:107:20
    #4 0x7f4cde722116 in Fbwlabeln(octave_value_list const&, int) /tmp/oct-Eyoziy/image-2.17.0+/src/bwlabeln.cc:395:12
    #5 0x7f4ce6710c4b in octave::tree_evaluator::execute_builtin_function(octave_builtin&, int, octave_value_list const&) /home/dmitri/src/octave/clang_asan/../libinterp/parse-tree/pt-eval.cc:35
...

(full trace is attached)

Dmitri.
--

Dmitri A. Sergatskov <dasergatskov>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #57026:  image_ASAN_crash_2.txt.gz added by dasergatskov (3KiB - application/gzip)
file #57025:  image_ASAN_crash.txt.gz added by dasergatskov (4KiB - application/gzip)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by avinoam (Posted a comment)
  • -email is unavailable- added by dasergatskov (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only group members can vote.

     

    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2025-03-23 avinoam Open/ClosedOpen Closed
    2025-03-23 avinoam StatusNone Fixed
    2025-03-16 dasergatskov Attached File- Added image_ASAN_crash_2.txt.gz, #57026
    2025-03-16 dasergatskov Attached File- Added image_ASAN_crash.txt.gz, #57025

    Back to the top

    Powered by Savane 3.14-962f.
    Corresponding source code