Skip to content

MultiViewParams::findTileNearestCams erroneously assumes non-empty array, leading to illegal read when indexing first element #2094

@SFN-eu

Description

@SFN-eu

While fixing #2093, I discovered that MultiViewParams::findTileNearestCams assumes that at least one tCamera id has a positive score, than calls qsort on an array it assumes to be non-empty.

The offending code is as follows: (MultiViewParams.cpp 650:659)

    std::vector<SortedId> ids;
    ids.reserve(tcScore.size());

    for (const auto& tcScorePair : tcScore)
    {
        if (tcScorePair.second > 0.0f)
            ids.push_back(SortedId(tcScorePair.first, tcScorePair.second));
    }

    qsort(&ids[0], ids.size(), sizeof(SortedId), qsortCompareSortedIdDesc);

    // ensure the ideal number of target cameras is not superior to the actual number of cameras
    const int maxTc = std::min(std::min(getNbCameras(), nbNearestCams), static_cast<int>(ids.size()));
    out.reserve(maxTc);

    for (int i = 0; i < maxTc; ++i)
        out.push_back(ids[i].id);

    return out;

(It even causes a SIGABRT when compiled in debug mode, because gcc bound checks the subscript operator when debugging)

A simple if statement could fix this and just return out before the sort if ids is empty. Again, like with #2093, will try to push up a patch and open a PR.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions