line detector crashes

[koenbrants]

System information (version)

• OpenCV => 3.4.5
• Operating System / Platform => Windows 64 Bit
• Compiler => Visual Studio 2015

Detailed description

1. Setup the Binary descriptor
2. call Detect method with data from file attached
   -> Crash due to memory corruption.

look at Method in file binary_descriptor.cpp

int BinaryDescriptor::EDLineDetector::EdgeDrawing( cv::Mat &image, EdgeChains &edgeChains )

e.g. line 1584 fills in a buffer
.cpp pFirstPartEdgeX_[offsetPFirst] = x; pFirstPartEdgeY_[offsetPFirst++] = y;

The offset keep growing in the while loops, overflowing the allocated memory.
After processing finishes, there is a check (line 2221)
.cpp if( offsetPFirst > edgePixelArraySize || offsetPSecond > edgePixelArraySize ) { std::cout << "Edge drawing Error: The total number of edge pixels is larger than MaxNumOfEdgePixels, " "numofedgePixel1 = " << offsetPFirst << ", numofedgePixel2 = " << offsetPSecond << ", MaxNumOfEdgePixel=" << edgePixelArraySize << std::endl; return -1; }

This check check for a buffer overrun, but the harm has already been done.

Steps to reproduce

```.cpp
  cv::Ptr<cv::line_descriptor::BinaryDescriptor> bd = cv::line_descriptor::BinaryDescriptor::createBinaryDescriptor();

  bd->setNumOfOctaves(1);
  bd->setReductionRatio(2);
  bd->setWidthOfBand(13);

  cv::Mat src = ::imread(cv::String(IMAGE_FILE));
  std::vector<cv::line_descriptor::KeyLine> lines;

  /* extract lines */
  bd->detect(src, lines);
```

[Pk13055]

Update: This the the referenced line.

In the code, the checks are being referenced in the conditions itself. @koenbrants What you're saying is that indexInArray + width may exceed the buffer dimensions?

[koenbrants]

For the buffer allocated here,

opencv_contrib/modules/line_descriptor/src/binary_descriptor.cpp

Line 1462 in 33f18dd

pFirstPartEdgeX_ = new unsigned int[edgePixelArraySize];

we can get a buffer overrun here

opencv_contrib/modules/line_descriptor/src/binary_descriptor.cpp

Lines 1571 to 1572 in 33f18dd

	pFirstPartEdgeX_[offsetPFirst] = x;
	pFirstPartEdgeY_[offsetPFirst++] = y;

After all loops have finished, there is a check at

opencv_contrib/modules/line_descriptor/src/binary_descriptor.cpp

Lines 2187 to 2192 in 33f18dd

	if( offsetPFirst > edgePixelArraySize || offsetPSecond > edgePixelArraySize )
	{
	std::cout << "Edge drawing Error: The total number of edge pixels is larger than MaxNumOfEdgePixels, "
	"numofedgePixel1 = " << offsetPFirst << ", numofedgePixel2 = " << offsetPSecond << ", MaxNumOfEdgePixel=" << edgePixelArraySize << std::endl;
	return -1;
	}

But at that moment the buffer has already been overran, hence corrupting memory .

[youruncleda]

in binary_descriptor.cpp file, in the function int BinaryDescriptor::EDLineDetector::EdgeDrawing( cv::Mat &image, EdgeChains &edgeChains ), the original code is
imageWidth = image.cols;
imageHeight = image.rows;
unsigned int pixelNum = imageWidth * imageHeight;

unsigned int edgePixelArraySize = pixelNum / 5;
unsigned int maxNumOfEdge = edgePixelArraySize / 20;

maybe should change to :
unsigned int edgePixelArraySize = pixelNum;
unsigned int maxNumOfEdge = edgePixelArraySize;