topic CopySubpix reads past the end of input buffer in Intel® Integrated Performance Primitives

CopySubpix reads past the end of input buffer

BMart1 — Mon, 14 Aug 2017 18:19:40 GMT

vector<uint8_t> input{ 10, 20, 100, 200, 10, 20, 100, 200, };
vector<uint8_t> output(2 * 4);
ippiCopySubpix_8u_C1R(input.data(), 2, output.data(), 2, { 2, 4 }, 0.5, 0);

fails with an exception when running under App Verifier with Heap checking and Protect checking. With these options app verifier inserts a page without read permission after input[8]. I bet valgrind also catches this. You can also tell that ipp is reading after the end of each line because the last pixel of each output line is the average of the last pixel of the input line and the first pixel of the next input line.

Hi Bruno,

Alice_H_Intel — Tue, 15 Aug 2017 07:02:09 GMT

Hi Bruno,

I'll investigate this and get back to you soon.

Thanks,

Alice

It still crashes in ipp 2018.

BMart1 — Tue, 03 Oct 2017 13:47:24 GMT

It still crashes in ipp 2018. I've made a simple repro that doesn't need app verifier:

#define _IPP_SEQUENTIAL_STATIC
#include <ippcore.h>
#include <ippvm.h>
#include <ipps.h>
#include <ippi.h>
#include <ippcv.h>
#include <cstdint>
#include <Windows.h>
using namespace std;

int main()
{
    static uint8_t const input[4][2] = {
        { 10, 20, },
        { 100, 200, },
        { 10, 20, },
        { 100, 200, },
    };
    uint8_t output[4][2]{};
    ippiCopySubpix_8u_C1R(input[0], 2, output[0], 2, { 2, 4 }, 0.5, 0);

    int const pagesize = 4 * 1024;
    void* mem = VirtualAlloc(nullptr, 2 * pagesize, MEM_RESERVE, PAGE_READWRITE); // reserve 2 pages
    VirtualAlloc(mem, pagesize, MEM_COMMIT, PAGE_READWRITE); // only commit the first, so reading from the second crashes
    uint8_t* guarded_input = (uint8_t*)mem + pagesize - sizeof input;
    memcpy(guarded_input, input, sizeof input); // copy input to end of first page
    ippiCopySubpix_8u_C1R(guarded_input, 2, output[0], 2, { 2, 4 }, 0.5, 0);
}

Maybe this is the correct

BMart1 — Mon, 08 Jan 2018 12:39:29 GMT

Maybe this is the correct behavior and borders need to be considered by hand?

Bruno,

Chao_Y_Intel — Tue, 09 Jan 2018 08:01:39 GMT

Bruno,
Thanks for the code. could you submit a support ticket for IPP product at our support portal: https://www.intel.com/supporttickets ?
so our support engineer can reproduce your test code there, to root the problem.
One document is attached if you want to learn some steps on submitting a ticket.

regards,
Chao

Just did.

BMart1 — Tue, 09 Jan 2018 10:50:13 GMT

Just did.

Hi Bruno,

Igor_A_Intel — Fri, 02 Mar 2018 14:13:34 GMT

Hi Bruno,

you are right - it is IPP ROI concept that is described in the manual - as this function doesn't support border parameter - by default its behavior is as for border "inmem" case:

for subpixel copying IPP uses linear interpolation, therefore it's customer's responsibility to provide all required pixels beyond provided ROI - in the attached example it means + 1 column to the right and +1 row at the bottom. See used formula below:

dst = (TYPE)ROUND(a00*src +a10*src[j+1]+ a01*src[j+srcStep]+a11*src[j+srcStep+1]);

regards, Igor.