| # OpenCV FileStorage `decodeFormat` stack buffer overflow (CWE-787) PoC |
|
|
| Proof of concept for a **stack buffer overflow / out-of-bounds write** in OpenCV's `FileStorage` |
| data-type parser, triggered when a `Mat` is read from a crafted `.json` or `.yml` model file. |
|
|
| This repository is **gated**: the crafted files are weaponized inputs. Access is pre-granted to |
| `protectai-bot` for huntr review. |
|
|
| ## What it is |
|
|
| `modules/core/src/persistence.cpp` → `decodeFormat(const char* dt, int* fmt_pairs, int max_len)` |
| writes one `(count, depth)` int pair per type token of the `dt` string into `fmt_pairs`. It does |
| `max_len *= 2` and only stops when the index reaches `2 * 128 = 256` ints. But two callers declare |
| the destination at the 1x size: |
|
|
| | caller | line | buffer | |
| |---|---|---| |
| | `decodeSimpleFormat()` | persistence.cpp:319 | `int fmt_pairs[CV_FS_MAX_FMT_PAIRS]` (128) | |
| | `calcElemSize()` | persistence.cpp:269 | `int fmt_pairs[CV_FS_MAX_FMT_PAIRS]` (128) | |
| | `writeRawData` / `readRaw` / `parseBase64` | 1140 / 1838 / 2645 | `[CV_FS_MAX_FMT_PAIRS * 2]` (256) ✔ | |
|
|
| `CV_FS_MAX_FMT_PAIRS = 128`. A `dt` with more than 64 type pairs overflows the 128-int stack buffer |
| by up to ~512 bytes. The overflowing values are the pair counts, parsed with `strtol(dt)`, so they |
| are attacker-controlled. |
|
|
| `decodeSimpleFormat()` is reached at load time from the matrix reader |
| `read(const FileNode&, Mat&)` (`persistence_types.cpp:130`) on the file's `dt` field, **before** |
| any validation. |
|
|
| ## Files |
|
|
| - `poc.json`, `poc.yml` — 1x1 matrix node `x` with a 120-pair `dt` (each count = `0x41414141`). |
| - `benign.json`, `benign.yml` — same files with a normal `dt`; load cleanly. |
| - `make_poc.py` — regenerates the files from a cv2-written valid skeleton. |
| - `verify.py` — child-process differential runner. |
| - `asan_repro.cpp`, `asan_report.txt` — standalone AddressSanitizer reproducer (the exact source of |
| `decodeFormat`/`decodeSimpleFormat`) and its report, deterministically showing |
| `stack-buffer-overflow WRITE of size 4`. |
| - `linux_verify.sh` — one-shot driver. |
|
|
| ## Reproduce (Linux, `pip install opencv-python` ≤ 4.13.0) |
|
|
| ``` |
| python make_poc.py |
| python verify.py |
| # benign.json rc=0 loaded ok |
| # poc.json rc=-11 CRASH (SIGSEGV) |
| # poc.yml rc=-11 CRASH (SIGSEGV) |
| |
| clang++ -O0 -g -fsanitize=address asan_repro.cpp -o asan_repro && ./asan_repro 120 |
| # AddressSanitizer: stack-buffer-overflow WRITE of size 4 in decodeFormat |
| ``` |
|
|
| ## Impact |
|
|
| Reading a `Mat` from an untrusted FileStorage file (directly, or via the `cv2.ml` model loaders |
| that persist as FileStorage) performs a controllable out-of-bounds stack write. Reliable outcome is |
| a process crash (DoS); ceiling is memory corruption / control-flow hijack subject to stack-protector |
| and ASLR. |
|
|
