Skip to content

Commit 6053825

Browse files
author
Andrey Kamaev
committed
Fix stack corruption in cvConvexHull2 and heap corruption in OutputArray::create
1 parent b28f594 commit 6053825

File tree

2 files changed

+5
-4
lines changed

2 files changed

+5
-4
lines changed

modules/core/src/matrix.cpp

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1548,10 +1548,10 @@ void _OutputArray::create(int dims, const int* sizes, int mtype, int i, bool all
15481548
int _type = CV_MAT_TYPE(flags);
15491549
for( size_t j = len0; j < len; j++ )
15501550
{
1551-
if( v[i].type() == _type )
1551+
if( v[j].type() == _type )
15521552
continue;
1553-
CV_Assert( v[i].empty() );
1554-
v[i].flags = (v[i].flags & ~CV_MAT_TYPE_MASK) | _type;
1553+
CV_Assert( v[j].empty() );
1554+
v[j].flags = (v[j].flags & ~CV_MAT_TYPE_MASK) | _type;
15551555
}
15561556
}
15571557
return;

modules/imgproc/src/convhull.cpp

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -455,7 +455,7 @@ cvConvexHull2( const CvArr* array, void* hull_storage,
455455

456456
hullseq = cvMakeSeqHeaderForArray(
457457
CV_SEQ_KIND_CURVE|CV_MAT_TYPE(mat->type)|CV_SEQ_FLAG_CLOSED,
458-
sizeof(contour_header), CV_ELEM_SIZE(mat->type), mat->data.ptr,
458+
sizeof(hull_header), CV_ELEM_SIZE(mat->type), mat->data.ptr,
459459
mat->cols + mat->rows - 1, &hull_header, &hullblock );
460460
cvClearSeq( hullseq );
461461
}
@@ -475,6 +475,7 @@ cvConvexHull2( const CvArr* array, void* hull_storage,
475475
cv::convexHull(cv::cvarrToMat(ptseq, false, false, 0, &_ptbuf), h0,
476476
orientation == CV_CLOCKWISE, CV_MAT_CN(hulltype) == 2);
477477

478+
478479
if( hulltype == CV_SEQ_ELTYPE_PPOINT )
479480
{
480481
const int* idx = h0.ptr<int>();

0 commit comments

Comments
 (0)