fix: guard LinearModelSolver minimal fast-path against a null sample#52
Draft
f-dy wants to merge 1 commit into
Draft
fix: guard LinearModelSolver minimal fast-path against a null sample#52f-dy wants to merge 1 commit into
f-dy wants to merge 1 commit into
Conversation
LinearModelSolver<2>/<3>::estimateModel has a minimal-sample fast-path that calls estimate2DLine/estimate3DPlane(data_, sample_, ...), which dereferences sample_[0..k-1]. But estimateModel explicitly supports sample_ == nullptr (meaning "use the first sampleNumber_ points"), as the general path below handles via 'sample_ == nullptr ? pointIdx : sample_[pointIdx]'. When the non-minimal fit is called with sample_ == nullptr AND sampleNumber_ == sampleSize() (e.g. MAGSAC's IRLS refitting on exactly sampleSize() collected inliers — 3 for a plane, 2 for a line), the fast-path dereferences the null pointer and crashes. Fix: only take the fast-path when 'sample_ != nullptr'; otherwise fall through to the general (null-safe) path. Two-character condition change, no behavior change for non-null samples. Verified with a direct repro: estimateModel(data, nullptr, sampleSize(), ...) SEGVs at estimate3DPlane (read of address 0) before the fix and returns normally after it.
This was referenced May 31, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
fix: guard LinearModelSolver minimal fast-path against a null sample
Problem
LinearModelSolver<2>/<3>(estimators/solver_linear_model.h) has aminimal-sample fast-path in
estimateModel:estimate2DLine/estimate3DPlaneindexsample_[0..k-1]. ButestimateModelexplicitly supports
sample_ == nullptr(meaning "use the firstsampleNumber_points") — the general path right below it does exactly that viaconst int sampleIdx = sample_ == nullptr ? pointIdx : sample_[pointIdx];.So when the non-minimal fit is called with
sample_ == nullptrandsampleNumber_ == sampleSize(), the fast-path dereferences a null pointer andcrashes. This happens in MAGSAC's IRLS (
sigmaConsensusPlusPlus), which refitson all collected inliers passing
sample_ = nullptr; when the inlier count isexactly
sampleSize()(3 for a plane, 2 for a line) it hits the fast-path.Fix
Only take the minimal fast-path when the sample is non-null; otherwise fall
through to the general, null-safe path:
Two-character change at each of the two sites. No behavior change for non-null
samples (the general path produces the same minimal-sample result).
Reproduction
Calling the non-minimal path directly with a null sample:
AddressSanitizer: SEGV on address 0x0atestimate3DPlane (solver_linear_model.h).Scope
Standalone crash fix, branched from
master, one file, zero coupling to thegamma/DoF/scoring work. (It was previously bundled into the per-estimator-DoF
PR #50; it is extracted here so it
can merge independently.)