CVE-2017-18009

Vulnerability

In OpenCV 3.3.1, the function cv::HdrDecoder::checkSignature in modules/imgcodecs/src/grfmt_hdr.cpp performs a heap-based buffer over-read. The function uses memcmp to compare the input signature against expected signatures (m_signature and m_signature_alt) without proper bounds checking [2][3]. Affected versions include 3.3.1 and potentially earlier releases [3].

Exploitation

An attacker must craft a malicious HDR image file with a specially truncated or malformed signature field. When a victim or application uses cv::imread() to load the file, the decoder reads beyond the allocated heap buffer of the signature string, causing an out-of-bounds read [3]. No authentication or special privileges are required beyond triggering the image decode path.

Impact

Successful exploitation results in a heap-based buffer over-read, which can cause a crash (denial of service) or potentially leak sensitive memory contents [2][3]. The read is limited to 10 bytes beyond the allocated region, as demonstrated by AddressSanitizer output [3]. Depending on the application, this may lead to information disclosure.

Mitigation

A fix was committed in pull request #10480 on GitHub, which adds proper size checks before calling memcmp [4]. Users should upgrade to OpenCV 3.4 or later, or apply the patch from commit 4ca89db22dea962690f31c1781bce5937ee91837 [4]. No workaround exists other than avoiding untrusted HDR files.