<h5 dir="auto">System information (version)</h5>

<ul dir="auto">
<li>OpenCV =&gt; commit: <a class="commit-link" data-hovercard-type="commit" data-hovercard-url="https://github.com/opencv/opencv/commit/1b07274e34378e83fa7ee67ca794e240f64f832a/hovercard" href="https://github.com/opencv/opencv/commit/1b07274e34378e83fa7ee67ca794e240f64f832a"><tt>1b07274</tt></a> (master branch latest commit)</li>
<li>Operating System / Platform =&gt; ubuntu 18.04</li>
<li>Compiler =&gt; clang++ 10.0.1</li>
</ul>
<h5 dir="auto">Detailed description</h5>

<h5 dir="auto">Steps to reproduce</h5>

<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="##### Issue submission checklist

 - [X] I report the issue, it's not a question
   &lt;!--
   OpenCV team works with forum.opencv.org, Stack Overflow and other communities
   to discuss problems. Tickets with questions without a real issue statement will be
   closed.
   --&gt;
 - [ X] I checked the problem with documentation, FAQ, open issues,
       forum.opencv.org, Stack Overflow, etc and have not found any solution
   &lt;!--
   Places to check:
   * OpenCV documentation: https://docs.opencv.org
   * FAQ page: https://github.com/opencv/opencv/wiki/FAQ
   * OpenCV forum: https://forum.opencv.org
   * OpenCV issue tracker: https://github.com/opencv/opencv/issues?q=is%3Aissue
   * Stack Overflow branch: https://stackoverflow.com/questions/tagged/opencv
   --&gt;
 - [X ] I updated to the latest OpenCV version and the issue is still there
   &lt;!--
   master branch for OpenCV 4.x and 3.4 branch for OpenCV 3.x releases.
   OpenCV team supports only the latest release for each branch.
   The ticket is closed if the problem is not reproduced with the modern version.
   --&gt;
 - [X ] There is reproducer code and related data files: videos, images, onnx, etc
   &lt;!--
   The best reproducer -- test case for OpenCV that we can add to the library.
   Recommendations for media files and binary files:
   * Try to reproduce the issue with images and videos in opencv_extra repository
     to reduce attachment size
   * Use PNG for images, if you report some CV related bug, but not image reader
     issue
   * Attach the image as an archive to the ticket, if you report some reader issue.
     Image hosting services compress images and it breaks the repro code.
   * Provide ONNX file for some public model or ONNX file with random weights,
     if you report ONNX parsing or handling issue. Architecture details diagram
     from netron tool can be very useful too. See https://lutzroeder.github.io/netron/
   --&gt;"><pre class="notranslate"><code class="notranslate">##### Issue submission checklist

 - [X] I report the issue, it's not a question
   &lt;!--
   OpenCV team works with forum.opencv.org, Stack Overflow and other communities
   to discuss problems. Tickets with questions without a real issue statement will be
   closed.
   --&gt;
 - [ X] I checked the problem with documentation, FAQ, open issues,
       forum.opencv.org, Stack Overflow, etc and have not found any solution
   &lt;!--
   Places to check:
   * OpenCV documentation: https://docs.opencv.org
   * FAQ page: https://github.com/opencv/opencv/wiki/FAQ
   * OpenCV forum: https://forum.opencv.org
   * OpenCV issue tracker: https://github.com/opencv/opencv/issues?q=is%3Aissue
   * Stack Overflow branch: https://stackoverflow.com/questions/tagged/opencv
   --&gt;
 - [X ] I updated to the latest OpenCV version and the issue is still there
   &lt;!--
   master branch for OpenCV 4.x and 3.4 branch for OpenCV 3.x releases.
   OpenCV team supports only the latest release for each branch.
   The ticket is closed if the problem is not reproduced with the modern version.
   --&gt;
 - [X ] There is reproducer code and related data files: videos, images, onnx, etc
   &lt;!--
   The best reproducer -- test case for OpenCV that we can add to the library.
   Recommendations for media files and binary files:
   * Try to reproduce the issue with images and videos in opencv_extra repository
     to reduce attachment size
   * Use PNG for images, if you report some CV related bug, but not image reader
     issue
   * Attach the image as an archive to the ticket, if you report some reader issue.
     Image hosting services compress images and it breaks the repro code.
   * Provide ONNX file for some public model or ONNX file with random weights,
     if you report ONNX parsing or handling issue. Architecture details diagram
     from netron tool can be very useful too. See https://lutzroeder.github.io/netron/
   --&gt;
</code></pre></div>
<h1 dir="auto">Reproduce code</h1>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="#include &quot;opencv2/dnn.hpp&quot;
#include &lt;fstream&gt;

using namespace cv;
using namespace dnn;

std::string Input1
    { 0x0a, 0x00, 0x0a, 0x00, 0x0a, 0x00, 0x0a, 0x00, 0x0a, 0x00, 0x0a, 0x00,
      (char)0xba, 0x0a, 0x00, 0x0a, 0x00, 0x0a, 0x00, 0x0a, 0x00, 0x0a, 0x00,
      0x0a, (char)0xbd, 0x00, 0x1a, 0x00, 0x0a, 0x00, 0x0a, 0x00, (char)0xba,
      0x0a, 0x00, 0x0a, 0x00, 0x0a, 0x00, 0x0a, 0x00, 0x0a, 0x00, 0x0a, 0x00,
      0x0a, 0x00, 0x0a, 0x00, 0x0a, 0x00, 0x0a, 0x00, (char)0xba, 0x0a, 0x00,
      0x0a, 0x00, 0x0a, 0x00, 0x0a, 0x00, 0x0a, 0x00, 0x0a, 0x00, (char)0xba,
      0x0a, 0x00, 0x0a, 0x00, 0x0a, 0x00, 0x0a, 0x00, 0x0a, 0x00, 0x0a, 0x00,
      0x0a, 0x00, 0x0a, 0x00, 0x0a, 0x00, 0x2a, 0x00, (char)0xba, 0x0a, 0x00,
      0x0a, 0x00, 0x5d, 0x00, 0x0a, 0x00, 0x0a, 0x00, 0x0a, 0x00, 0x0a, 0x40 };
std::string Input1Path = &quot;Input1&quot;;

bool saveFile(std::string Path, std::string Content) {
  std::ofstream OFS(Path);
  if (!OFS.is_open())
    return false;

  OFS &lt;&lt; Content;
  return true;
}

int main(int argc, char* argv[]) {
  if (!saveFile(Input1Path, Input1)) return 1;

  Net net;
  net = readNetFromTensorflow(Input1Path);
  return 0;
}	"><pre class="notranslate"><code class="notranslate">#include "opencv2/dnn.hpp"
#include &lt;fstream&gt;

using namespace cv;
using namespace dnn;

std::string Input1
    { 0x0a, 0x00, 0x0a, 0x00, 0x0a, 0x00, 0x0a, 0x00, 0x0a, 0x00, 0x0a, 0x00,
      (char)0xba, 0x0a, 0x00, 0x0a, 0x00, 0x0a, 0x00, 0x0a, 0x00, 0x0a, 0x00,
      0x0a, (char)0xbd, 0x00, 0x1a, 0x00, 0x0a, 0x00, 0x0a, 0x00, (char)0xba,
      0x0a, 0x00, 0x0a, 0x00, 0x0a, 0x00, 0x0a, 0x00, 0x0a, 0x00, 0x0a, 0x00,
      0x0a, 0x00, 0x0a, 0x00, 0x0a, 0x00, 0x0a, 0x00, (char)0xba, 0x0a, 0x00,
      0x0a, 0x00, 0x0a, 0x00, 0x0a, 0x00, 0x0a, 0x00, 0x0a, 0x00, (char)0xba,
      0x0a, 0x00, 0x0a, 0x00, 0x0a, 0x00, 0x0a, 0x00, 0x0a, 0x00, 0x0a, 0x00,
      0x0a, 0x00, 0x0a, 0x00, 0x0a, 0x00, 0x2a, 0x00, (char)0xba, 0x0a, 0x00,
      0x0a, 0x00, 0x5d, 0x00, 0x0a, 0x00, 0x0a, 0x00, 0x0a, 0x00, 0x0a, 0x40 };
std::string Input1Path = "Input1";

bool saveFile(std::string Path, std::string Content) {
  std::ofstream OFS(Path);
  if (!OFS.is_open())
    return false;

  OFS &lt;&lt; Content;
  return true;
}

int main(int argc, char* argv[]) {
  if (!saveFile(Input1Path, Input1)) return 1;

  Net net;
  net = readNetFromTensorflow(Input1Path);
  return 0;
}	
</code></pre></div>
<h1 dir="auto">Build steps to opencv</h1>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="mkdir -p build &amp;&amp; cd build
cmake -DBUILD_SHARED_LIBS=OFF -DOPENCV_ENABLE_ALLOCATOR_STATS=OFF -DCMAKE_C_COMPILER=clang -DCMAKE_CXX_COMPILER=clang++ -DCMAKE_AR=/bin/llvm-ar -DCMAKE_C_FLAGS=&quot;-fsanitize=address,fuzzer-no-link -fno-omit-frame-pointer -g&quot; -DCMAKE_CXX_FLAGS=&quot;-fsanitize=address,fuzzer-no-link -fno-omit-frame-pointer -g&quot; -DCMAKE_EXE_LINKER_FLAGS=&quot;-fsanitize=address,fuzzer-no-link -fno-omit-frame-pointer -g&quot; -DCMAKE_SHARED_LINKER_FLAGS=&quot;-fsanitize=address,fuzzer-no-link -fno-omit-frame-pointer -g&quot; ..
make -j16"><pre class="notranslate"><code class="notranslate">mkdir -p build &amp;&amp; cd build
cmake -DBUILD_SHARED_LIBS=OFF -DOPENCV_ENABLE_ALLOCATOR_STATS=OFF -DCMAKE_C_COMPILER=clang -DCMAKE_CXX_COMPILER=clang++ -DCMAKE_AR=/bin/llvm-ar -DCMAKE_C_FLAGS="-fsanitize=address,fuzzer-no-link -fno-omit-frame-pointer -g" -DCMAKE_CXX_FLAGS="-fsanitize=address,fuzzer-no-link -fno-omit-frame-pointer -g" -DCMAKE_EXE_LINKER_FLAGS="-fsanitize=address,fuzzer-no-link -fno-omit-frame-pointer -g" -DCMAKE_SHARED_LINKER_FLAGS="-fsanitize=address,fuzzer-no-link -fno-omit-frame-pointer -g" ..
make -j16
</code></pre></div>
<h1 dir="auto">Reason</h1>
<p dir="auto">tf_graph_simplifier.cpp : sortByExecutionOrder(tensorflow::GraphDef&amp; net)</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="void sortByExecutionOrder(tensorflow::GraphDef&amp; net)
{
...
std::map&lt;std::string, int&gt; nodesMap;
...
987~991
    for (int i = 0; i &lt; net.node_size(); ++i)
    {
        const tensorflow::NodeDef&amp; node = net.node(i);
        nodesMap.insert(std::make_pair(node.name(), i)); //nodesMap size and net.node_size() can be different if there is duplicated node.name() in net instance.
    }
...
995
std::vector&lt;int&gt; numRefsToAdd(nodesMap.size(), 0); //numRefsToAdd size is depends on nodesMap.size().
...
997
for (int i = 0; i &lt; net.node_size(); ++i) //loop from 0 to net.node_size().
...
1026
                numRefsToAdd[i] = numInputsInGraph; // numRegsToAdd is accessed with index i that depends on net.node_size(). However, numRefsToAdd's size is depends on nodesMap size that can be smaller than net.node_size(), finally heap overflow happened.
..."><pre class="notranslate"><code class="notranslate">void sortByExecutionOrder(tensorflow::GraphDef&amp; net)
{
...
std::map&lt;std::string, int&gt; nodesMap;
...
987~991
    for (int i = 0; i &lt; net.node_size(); ++i)
    {
        const tensorflow::NodeDef&amp; node = net.node(i);
        nodesMap.insert(std::make_pair(node.name(), i)); //nodesMap size and net.node_size() can be different if there is duplicated node.name() in net instance.
    }
...
995
std::vector&lt;int&gt; numRefsToAdd(nodesMap.size(), 0); //numRefsToAdd size is depends on nodesMap.size().
...
997
for (int i = 0; i &lt; net.node_size(); ++i) //loop from 0 to net.node_size().
...
1026
                numRefsToAdd[i] = numInputsInGraph; // numRegsToAdd is accessed with index i that depends on net.node_size(). However, numRefsToAdd's size is depends on nodesMap size that can be smaller than net.node_size(), finally heap overflow happened.
...
</code></pre></div>
<h1 dir="auto">Address Sanitizer Report</h1>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="==11303==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000002578 at pc 0x000000762ffc bp 0x7fff554bd0f0 sp 0x7fff554bd0e8
WRITE of size 4 at 0x602000002578 thread T0
    #0 0x762ffb in cv::dnn::dnn4_v20211220::sortByExecutionOrder(opencv_tensorflow::GraphDef&amp;) /root/fuzz-test-generation/exp/opencv/modules/dnn/src/tensorflow/tf_graph_simplifier.cpp:1026:33
    #1 0x5f0fe9 in cv::dnn::dnn4_v20211220::(anonymous namespace)::TFImporter::populateNet() /root/fuzz-test-generation/exp/opencv/modules/dnn/src/tensorflow/tf_importer.cpp:3018:9
    #2 0x5e6743 in cv::dnn::dnn4_v20211220::(anonymous namespace)::TFImporter::TFImporter(cv::dnn::dnn4_v20211220::Net&amp;, char const*, char const*) /root/fuzz-test-generation/exp/opencv/modules/dnn/src/tensorflow/tf_importer.cpp:2709:5
    #3 0x5e6743 in cv::dnn::dnn4_v20211220::Net cv::dnn::dnn4_v20211220::detail::readNet&lt;cv::dnn::dnn4_v20211220::(anonymous namespace)::TFImporter, char const*, char const*&gt;(char const*&amp;&amp;, char const*&amp;&amp;) /root/fuzz-test-generation/exp/opencv/modules/dnn/src/tensorflow/../dnn_common.hpp:75:14
    #4 0x5e2b33 in cv::dnn::dnn4_v20211220::Net cv::dnn::dnn4_v20211220::detail::readNetDiagnostic&lt;cv::dnn::dnn4_v20211220::(anonymous namespace)::TFImporter, char const*, char const*&gt;(char const*&amp;&amp;, char const*&amp;&amp;) /root/fuzz-test-generation/exp/opencv/modules/dnn/src/tensorflow/../dnn_common.hpp:82:25
    #5 0x5e2b33 in cv::dnn::dnn4_v20211220::readNetFromTensorflow(std::__cxx11::basic_string&lt;char, std::char_traits&lt;char&gt;, std::allocator&lt;char&gt; &gt; const&amp;, std::__cxx11::basic_string&lt;char, std::char_traits&lt;char&gt;, std::allocator&lt;char&gt; &gt; const&amp;) /root/fuzz-test-generation/exp/opencv/modules/dnn/src/tensorflow/tf_importer.cpp:3219:12
    #6 0x4d90ce in main (/root/fuzz-test-generation/exp/opencv/fuzzer/imread/crash_3/crash+0x4d90ce)
    #7 0x7fafffa17c86 in __libc_start_main /build/glibc-uZu3wS/glibc-2.27/csu/../csu/libc-start.c:310
    #8 0x42e459 in _start (/root/fuzz-test-generation/exp/opencv/fuzzer/imread/crash_3/crash+0x42e459)

0x602000002578 is located 4 bytes to the right of 4-byte region [0x602000002570,0x602000002574)
freed by thread T0 here:
    #0 0x4d6b6d in operator delete(void*) (/root/fuzz-test-generation/exp/opencv/fuzzer/imread/crash_3/crash+0x4d6b6d)
    #1 0x7611f5 in __gnu_cxx::new_allocator&lt;int&gt;::deallocate(int*, unsigned long) /usr/lib/gcc/x86_64-linux-gnu/7.5.0/../../../../include/c++/7.5.0/ext/new_allocator.h:125:2
    #2 0x7611f5 in std::allocator_traits&lt;std::allocator&lt;int&gt; &gt;::deallocate(std::allocator&lt;int&gt;&amp;, int*, unsigned long) /usr/lib/gcc/x86_64-linux-gnu/7.5.0/../../../../include/c++/7.5.0/bits/alloc_traits.h:462:13
    #3 0x7611f5 in std::_Vector_base&lt;int, std::allocator&lt;int&gt; &gt;::_M_deallocate(int*, unsigned long) /usr/lib/gcc/x86_64-linux-gnu/7.5.0/../../../../include/c++/7.5.0/bits/stl_vector.h:180:4
    #4 0x7611f5 in void std::vector&lt;int, std::allocator&lt;int&gt; &gt;::_M_realloc_insert&lt;int const&amp;&gt;(__gnu_cxx::__normal_iterator&lt;int*, std::vector&lt;int, std::allocator&lt;int&gt; &gt; &gt;, int const&amp;) /usr/lib/gcc/x86_64-linux-gnu/7.5.0/../../../../include/c++/7.5.0/bits/vector.tcc:448:7
    #5 0x7611f5 in std::vector&lt;int, std::allocator&lt;int&gt; &gt;::push_back(int const&amp;) /usr/lib/gcc/x86_64-linux-gnu/7.5.0/../../../../include/c++/7.5.0/bits/stl_vector.h:948:4
    #6 0x7611f5 in cv::dnn::dnn4_v20211220::sortByExecutionOrder(opencv_tensorflow::GraphDef&amp;) /root/fuzz-test-generation/exp/opencv/modules/dnn/src/tensorflow/tf_graph_simplifier.cpp:1015:24
    #7 0x5f0fe9 in cv::dnn::dnn4_v20211220::(anonymous namespace)::TFImporter::populateNet() /root/fuzz-test-generation/exp/opencv/modules/dnn/src/tensorflow/tf_importer.cpp:3018:9
    #8 0x5e6743 in cv::dnn::dnn4_v20211220::(anonymous namespace)::TFImporter::TFImporter(cv::dnn::dnn4_v20211220::Net&amp;, char const*, char const*) /root/fuzz-test-generation/exp/opencv/modules/dnn/src/tensorflow/tf_importer.cpp:2709:5
    #9 0x5e6743 in cv::dnn::dnn4_v20211220::Net cv::dnn::dnn4_v20211220::detail::readNet&lt;cv::dnn::dnn4_v20211220::(anonymous namespace)::TFImporter, char const*, char const*&gt;(char const*&amp;&amp;, char const*&amp;&amp;) /root/fuzz-test-generation/exp/opencv/modules/dnn/src/tensorflow/../dnn_common.hpp:75:14
    #10 0x5e2b33 in cv::dnn::dnn4_v20211220::Net cv::dnn::dnn4_v20211220::detail::readNetDiagnostic&lt;cv::dnn::dnn4_v20211220::(anonymous namespace)::TFImporter, char const*, char const*&gt;(char const*&amp;&amp;, char const*&amp;&amp;) /root/fuzz-test-generation/exp/opencv/modules/dnn/src/tensorflow/../dnn_common.hpp:82:25
    #11 0x5e2b33 in cv::dnn::dnn4_v20211220::readNetFromTensorflow(std::__cxx11::basic_string&lt;char, std::char_traits&lt;char&gt;, std::allocator&lt;char&gt; &gt; const&amp;, std::__cxx11::basic_string&lt;char, std::char_traits&lt;char&gt;, std::allocator&lt;char&gt; &gt; const&amp;) /root/fuzz-test-generation/exp/opencv/modules/dnn/src/tensorflow/tf_importer.cpp:3219:12
    #12 0x4d90ce in main (/root/fuzz-test-generation/exp/opencv/fuzzer/imread/crash_3/crash+0x4d90ce)
    #13 0x7fafffa17c86 in __libc_start_main /build/glibc-uZu3wS/glibc-2.27/csu/../csu/libc-start.c:310

previously allocated by thread T0 here:
    #0 0x4d630d in operator new(unsigned long) (/root/fuzz-test-generation/exp/opencv/fuzzer/imread/crash_3/crash+0x4d630d)
    #1 0x76116c in __gnu_cxx::new_allocator&lt;int&gt;::allocate(unsigned long, void const*) /usr/lib/gcc/x86_64-linux-gnu/7.5.0/../../../../include/c++/7.5.0/ext/new_allocator.h:111:27
    #2 0x76116c in std::allocator_traits&lt;std::allocator&lt;int&gt; &gt;::allocate(std::allocator&lt;int&gt;&amp;, unsigned long) /usr/lib/gcc/x86_64-linux-gnu/7.5.0/../../../../include/c++/7.5.0/bits/alloc_traits.h:436:20
    #3 0x76116c in std::_Vector_base&lt;int, std::allocator&lt;int&gt; &gt;::_M_allocate(unsigned long) /usr/lib/gcc/x86_64-linux-gnu/7.5.0/../../../../include/c++/7.5.0/bits/stl_vector.h:172:20
    #4 0x76116c in void std::vector&lt;int, std::allocator&lt;int&gt; &gt;::_M_realloc_insert&lt;int const&amp;&gt;(__gnu_cxx::__normal_iterator&lt;int*, std::vector&lt;int, std::allocator&lt;int&gt; &gt; &gt;, int const&amp;) /usr/lib/gcc/x86_64-linux-gnu/7.5.0/../../../../include/c++/7.5.0/bits/vector.tcc:406:33
    #5 0x76116c in std::vector&lt;int, std::allocator&lt;int&gt; &gt;::push_back(int const&amp;) /usr/lib/gcc/x86_64-linux-gnu/7.5.0/../../../../include/c++/7.5.0/bits/stl_vector.h:948:4
    #6 0x76116c in cv::dnn::dnn4_v20211220::sortByExecutionOrder(opencv_tensorflow::GraphDef&amp;) /root/fuzz-test-generation/exp/opencv/modules/dnn/src/tensorflow/tf_graph_simplifier.cpp:1015:24
    #7 0x5f0fe9 in cv::dnn::dnn4_v20211220::(anonymous namespace)::TFImporter::populateNet() /root/fuzz-test-generation/exp/opencv/modules/dnn/src/tensorflow/tf_importer.cpp:3018:9
    #8 0x5e6743 in cv::dnn::dnn4_v20211220::(anonymous namespace)::TFImporter::TFImporter(cv::dnn::dnn4_v20211220::Net&amp;, char const*, char const*) /root/fuzz-test-generation/exp/opencv/modules/dnn/src/tensorflow/tf_importer.cpp:2709:5
    #9 0x5e6743 in cv::dnn::dnn4_v20211220::Net cv::dnn::dnn4_v20211220::detail::readNet&lt;cv::dnn::dnn4_v20211220::(anonymous namespace)::TFImporter, char const*, char const*&gt;(char const*&amp;&amp;, char const*&amp;&amp;) /root/fuzz-test-generation/exp/opencv/modules/dnn/src/tensorflow/../dnn_common.hpp:75:14
    #10 0x5e2b33 in cv::dnn::dnn4_v20211220::Net cv::dnn::dnn4_v20211220::detail::readNetDiagnostic&lt;cv::dnn::dnn4_v20211220::(anonymous namespace)::TFImporter, char const*, char const*&gt;(char const*&amp;&amp;, char const*&amp;&amp;) /root/fuzz-test-generation/exp/opencv/modules/dnn/src/tensorflow/../dnn_common.hpp:82:25
    #11 0x5e2b33 in cv::dnn::dnn4_v20211220::readNetFromTensorflow(std::__cxx11::basic_string&lt;char, std::char_traits&lt;char&gt;, std::allocator&lt;char&gt; &gt; const&amp;, std::__cxx11::basic_string&lt;char, std::char_traits&lt;char&gt;, std::allocator&lt;char&gt; &gt; const&amp;) /root/fuzz-test-generation/exp/opencv/modules/dnn/src/tensorflow/tf_importer.cpp:3219:12
    #12 0x4d90ce in main (/root/fuzz-test-generation/exp/opencv/fuzzer/imread/crash_3/crash+0x4d90ce)
    #13 0x7fafffa17c86 in __libc_start_main /build/glibc-uZu3wS/glibc-2.27/csu/../csu/libc-start.c:310

SUMMARY: AddressSanitizer: heap-buffer-overflow /root/fuzz-test-generation/exp/opencv/modules/dnn/src/tensorflow/tf_graph_simplifier.cpp:1026:33 in cv::dnn::dnn4_v20211220::sortByExecutionOrder(opencv_tensorflow::GraphDef&amp;)
Shadow bytes around the buggy address:
  0x0c047fff8450: fa fa fd fa fa fa fd fd fa fa fd fd fa fa fd fa
  0x0c047fff8460: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa
  0x0c047fff8470: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa
  0x0c047fff8480: fa fa fd fa fa fa fd fd fa fa fd fd fa fa fd fa
  0x0c047fff8490: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fd
=&gt;0x0c047fff84a0: fa fa fd fd fa fa fd fd fa fa 04 fa fa fa fd[fa]
  0x0c047fff84b0: fa fa fd fa fa fa fd fd fa fa 04 fa fa fa fa fa
  0x0c047fff84c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff84d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff84e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff84f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==11303==ABORTING"><pre class="notranslate"><code class="notranslate">==11303==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000002578 at pc 0x000000762ffc bp 0x7fff554bd0f0 sp 0x7fff554bd0e8
WRITE of size 4 at 0x602000002578 thread T0
    #0 0x762ffb in cv::dnn::dnn4_v20211220::sortByExecutionOrder(opencv_tensorflow::GraphDef&amp;) /root/fuzz-test-generation/exp/opencv/modules/dnn/src/tensorflow/tf_graph_simplifier.cpp:1026:33
    #1 0x5f0fe9 in cv::dnn::dnn4_v20211220::(anonymous namespace)::TFImporter::populateNet() /root/fuzz-test-generation/exp/opencv/modules/dnn/src/tensorflow/tf_importer.cpp:3018:9
    #2 0x5e6743 in cv::dnn::dnn4_v20211220::(anonymous namespace)::TFImporter::TFImporter(cv::dnn::dnn4_v20211220::Net&amp;, char const*, char const*) /root/fuzz-test-generation/exp/opencv/modules/dnn/src/tensorflow/tf_importer.cpp:2709:5
    #3 0x5e6743 in cv::dnn::dnn4_v20211220::Net cv::dnn::dnn4_v20211220::detail::readNet&lt;cv::dnn::dnn4_v20211220::(anonymous namespace)::TFImporter, char const*, char const*&gt;(char const*&amp;&amp;, char const*&amp;&amp;) /root/fuzz-test-generation/exp/opencv/modules/dnn/src/tensorflow/../dnn_common.hpp:75:14
    #4 0x5e2b33 in cv::dnn::dnn4_v20211220::Net cv::dnn::dnn4_v20211220::detail::readNetDiagnostic&lt;cv::dnn::dnn4_v20211220::(anonymous namespace)::TFImporter, char const*, char const*&gt;(char const*&amp;&amp;, char const*&amp;&amp;) /root/fuzz-test-generation/exp/opencv/modules/dnn/src/tensorflow/../dnn_common.hpp:82:25
    #5 0x5e2b33 in cv::dnn::dnn4_v20211220::readNetFromTensorflow(std::__cxx11::basic_string&lt;char, std::char_traits&lt;char&gt;, std::allocator&lt;char&gt; &gt; const&amp;, std::__cxx11::basic_string&lt;char, std::char_traits&lt;char&gt;, std::allocator&lt;char&gt; &gt; const&amp;) /root/fuzz-test-generation/exp/opencv/modules/dnn/src/tensorflow/tf_importer.cpp:3219:12
    #6 0x4d90ce in main (/root/fuzz-test-generation/exp/opencv/fuzzer/imread/crash_3/crash+0x4d90ce)
    #7 0x7fafffa17c86 in __libc_start_main /build/glibc-uZu3wS/glibc-2.27/csu/../csu/libc-start.c:310
    #8 0x42e459 in _start (/root/fuzz-test-generation/exp/opencv/fuzzer/imread/crash_3/crash+0x42e459)

0x602000002578 is located 4 bytes to the right of 4-byte region [0x602000002570,0x602000002574)
freed by thread T0 here:
    #0 0x4d6b6d in operator delete(void*) (/root/fuzz-test-generation/exp/opencv/fuzzer/imread/crash_3/crash+0x4d6b6d)
    #1 0x7611f5 in __gnu_cxx::new_allocator&lt;int&gt;::deallocate(int*, unsigned long) /usr/lib/gcc/x86_64-linux-gnu/7.5.0/../../../../include/c++/7.5.0/ext/new_allocator.h:125:2
    #2 0x7611f5 in std::allocator_traits&lt;std::allocator&lt;int&gt; &gt;::deallocate(std::allocator&lt;int&gt;&amp;, int*, unsigned long) /usr/lib/gcc/x86_64-linux-gnu/7.5.0/../../../../include/c++/7.5.0/bits/alloc_traits.h:462:13
    #3 0x7611f5 in std::_Vector_base&lt;int, std::allocator&lt;int&gt; &gt;::_M_deallocate(int*, unsigned long) /usr/lib/gcc/x86_64-linux-gnu/7.5.0/../../../../include/c++/7.5.0/bits/stl_vector.h:180:4
    #4 0x7611f5 in void std::vector&lt;int, std::allocator&lt;int&gt; &gt;::_M_realloc_insert&lt;int const&amp;&gt;(__gnu_cxx::__normal_iterator&lt;int*, std::vector&lt;int, std::allocator&lt;int&gt; &gt; &gt;, int const&amp;) /usr/lib/gcc/x86_64-linux-gnu/7.5.0/../../../../include/c++/7.5.0/bits/vector.tcc:448:7
    #5 0x7611f5 in std::vector&lt;int, std::allocator&lt;int&gt; &gt;::push_back(int const&amp;) /usr/lib/gcc/x86_64-linux-gnu/7.5.0/../../../../include/c++/7.5.0/bits/stl_vector.h:948:4
    #6 0x7611f5 in cv::dnn::dnn4_v20211220::sortByExecutionOrder(opencv_tensorflow::GraphDef&amp;) /root/fuzz-test-generation/exp/opencv/modules/dnn/src/tensorflow/tf_graph_simplifier.cpp:1015:24
    #7 0x5f0fe9 in cv::dnn::dnn4_v20211220::(anonymous namespace)::TFImporter::populateNet() /root/fuzz-test-generation/exp/opencv/modules/dnn/src/tensorflow/tf_importer.cpp:3018:9
    #8 0x5e6743 in cv::dnn::dnn4_v20211220::(anonymous namespace)::TFImporter::TFImporter(cv::dnn::dnn4_v20211220::Net&amp;, char const*, char const*) /root/fuzz-test-generation/exp/opencv/modules/dnn/src/tensorflow/tf_importer.cpp:2709:5
    #9 0x5e6743 in cv::dnn::dnn4_v20211220::Net cv::dnn::dnn4_v20211220::detail::readNet&lt;cv::dnn::dnn4_v20211220::(anonymous namespace)::TFImporter, char const*, char const*&gt;(char const*&amp;&amp;, char const*&amp;&amp;) /root/fuzz-test-generation/exp/opencv/modules/dnn/src/tensorflow/../dnn_common.hpp:75:14
    #10 0x5e2b33 in cv::dnn::dnn4_v20211220::Net cv::dnn::dnn4_v20211220::detail::readNetDiagnostic&lt;cv::dnn::dnn4_v20211220::(anonymous namespace)::TFImporter, char const*, char const*&gt;(char const*&amp;&amp;, char const*&amp;&amp;) /root/fuzz-test-generation/exp/opencv/modules/dnn/src/tensorflow/../dnn_common.hpp:82:25
    #11 0x5e2b33 in cv::dnn::dnn4_v20211220::readNetFromTensorflow(std::__cxx11::basic_string&lt;char, std::char_traits&lt;char&gt;, std::allocator&lt;char&gt; &gt; const&amp;, std::__cxx11::basic_string&lt;char, std::char_traits&lt;char&gt;, std::allocator&lt;char&gt; &gt; const&amp;) /root/fuzz-test-generation/exp/opencv/modules/dnn/src/tensorflow/tf_importer.cpp:3219:12
    #12 0x4d90ce in main (/root/fuzz-test-generation/exp/opencv/fuzzer/imread/crash_3/crash+0x4d90ce)
    #13 0x7fafffa17c86 in __libc_start_main /build/glibc-uZu3wS/glibc-2.27/csu/../csu/libc-start.c:310

previously allocated by thread T0 here:
    #0 0x4d630d in operator new(unsigned long) (/root/fuzz-test-generation/exp/opencv/fuzzer/imread/crash_3/crash+0x4d630d)
    #1 0x76116c in __gnu_cxx::new_allocator&lt;int&gt;::allocate(unsigned long, void const*) /usr/lib/gcc/x86_64-linux-gnu/7.5.0/../../../../include/c++/7.5.0/ext/new_allocator.h:111:27
    #2 0x76116c in std::allocator_traits&lt;std::allocator&lt;int&gt; &gt;::allocate(std::allocator&lt;int&gt;&amp;, unsigned long) /usr/lib/gcc/x86_64-linux-gnu/7.5.0/../../../../include/c++/7.5.0/bits/alloc_traits.h:436:20
    #3 0x76116c in std::_Vector_base&lt;int, std::allocator&lt;int&gt; &gt;::_M_allocate(unsigned long) /usr/lib/gcc/x86_64-linux-gnu/7.5.0/../../../../include/c++/7.5.0/bits/stl_vector.h:172:20
    #4 0x76116c in void std::vector&lt;int, std::allocator&lt;int&gt; &gt;::_M_realloc_insert&lt;int const&amp;&gt;(__gnu_cxx::__normal_iterator&lt;int*, std::vector&lt;int, std::allocator&lt;int&gt; &gt; &gt;, int const&amp;) /usr/lib/gcc/x86_64-linux-gnu/7.5.0/../../../../include/c++/7.5.0/bits/vector.tcc:406:33
    #5 0x76116c in std::vector&lt;int, std::allocator&lt;int&gt; &gt;::push_back(int const&amp;) /usr/lib/gcc/x86_64-linux-gnu/7.5.0/../../../../include/c++/7.5.0/bits/stl_vector.h:948:4
    #6 0x76116c in cv::dnn::dnn4_v20211220::sortByExecutionOrder(opencv_tensorflow::GraphDef&amp;) /root/fuzz-test-generation/exp/opencv/modules/dnn/src/tensorflow/tf_graph_simplifier.cpp:1015:24
    #7 0x5f0fe9 in cv::dnn::dnn4_v20211220::(anonymous namespace)::TFImporter::populateNet() /root/fuzz-test-generation/exp/opencv/modules/dnn/src/tensorflow/tf_importer.cpp:3018:9
    #8 0x5e6743 in cv::dnn::dnn4_v20211220::(anonymous namespace)::TFImporter::TFImporter(cv::dnn::dnn4_v20211220::Net&amp;, char const*, char const*) /root/fuzz-test-generation/exp/opencv/modules/dnn/src/tensorflow/tf_importer.cpp:2709:5
    #9 0x5e6743 in cv::dnn::dnn4_v20211220::Net cv::dnn::dnn4_v20211220::detail::readNet&lt;cv::dnn::dnn4_v20211220::(anonymous namespace)::TFImporter, char const*, char const*&gt;(char const*&amp;&amp;, char const*&amp;&amp;) /root/fuzz-test-generation/exp/opencv/modules/dnn/src/tensorflow/../dnn_common.hpp:75:14
    #10 0x5e2b33 in cv::dnn::dnn4_v20211220::Net cv::dnn::dnn4_v20211220::detail::readNetDiagnostic&lt;cv::dnn::dnn4_v20211220::(anonymous namespace)::TFImporter, char const*, char const*&gt;(char const*&amp;&amp;, char const*&amp;&amp;) /root/fuzz-test-generation/exp/opencv/modules/dnn/src/tensorflow/../dnn_common.hpp:82:25
    #11 0x5e2b33 in cv::dnn::dnn4_v20211220::readNetFromTensorflow(std::__cxx11::basic_string&lt;char, std::char_traits&lt;char&gt;, std::allocator&lt;char&gt; &gt; const&amp;, std::__cxx11::basic_string&lt;char, std::char_traits&lt;char&gt;, std::allocator&lt;char&gt; &gt; const&amp;) /root/fuzz-test-generation/exp/opencv/modules/dnn/src/tensorflow/tf_importer.cpp:3219:12
    #12 0x4d90ce in main (/root/fuzz-test-generation/exp/opencv/fuzzer/imread/crash_3/crash+0x4d90ce)
    #13 0x7fafffa17c86 in __libc_start_main /build/glibc-uZu3wS/glibc-2.27/csu/../csu/libc-start.c:310

SUMMARY: AddressSanitizer: heap-buffer-overflow /root/fuzz-test-generation/exp/opencv/modules/dnn/src/tensorflow/tf_graph_simplifier.cpp:1026:33 in cv::dnn::dnn4_v20211220::sortByExecutionOrder(opencv_tensorflow::GraphDef&amp;)
Shadow bytes around the buggy address:
  0x0c047fff8450: fa fa fd fa fa fa fd fd fa fa fd fd fa fa fd fa
  0x0c047fff8460: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa
  0x0c047fff8470: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa
  0x0c047fff8480: fa fa fd fa fa fa fd fd fa fa fd fd fa fa fd fa
  0x0c047fff8490: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fd
=&gt;0x0c047fff84a0: fa fa fd fd fa fa fd fd fa fa 04 fa fa fa fd[fa]
  0x0c047fff84b0: fa fa fd fa fa fa fd fd fa fa 04 fa fa fa fa fa
  0x0c047fff84c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff84d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff84e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff84f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==11303==ABORTING
</code></pre></div>
<h1 dir="auto">Effect</h1>
<p dir="auto">This bug may cause security vulnerability by reading invalid memory address.</p>
<h1 dir="auto">Recommendations</h1>
<p dir="auto">2 suggestions for opencv security improvements.<br>
[1] Request CVE number for this bug to inform opencv users to prevent potential security vulnerabilities.<br>
[2] Register below fuzzer code to ossfuzz (<a href="https://github.com/google/oss-fuzz">https://github.com/google/oss-fuzz</a>) for continuous fuzzing.<br>
(This fuzzer already found fixes <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="1199814447" data-permission-text="Title is private" data-url="https://github.com/opencv/opencv/issues/21852" data-hovercard-type="issue" data-hovercard-url="/opencv/opencv/issues/21852/hovercard" href="https://github.com/opencv/opencv/issues/21852">#21852</a>, and found this bug again.)<br>
ossfuzz already has fuzzers for opencv thus only commit below fuzzer code and build script to ossfuzz is enough I think.<br>
(<a href="https://github.com/google/oss-fuzz/tree/master/projects/opencv">https://github.com/google/oss-fuzz/tree/master/projects/opencv</a>)<br>
Note that, the git repo of UTopia project(<a href="https://github.com/Samsung/UTopia">https://github.com/Samsung/UTopia</a>) is currently empty and will be updated until the end of May.</p>
<p dir="auto">FuzzerCode:</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="/*
 * This fuzzer is generated by UTopia project based on TEST(Test_Tensorflow, read_inception).
 * (UTopia Project: https://github.com/Samsung/UTopia)
 */
#include &lt;opencv2/dnn/dnn.hpp&gt;
#include &lt;opencv2/imgcodecs.hpp&gt;
#include &lt;opencv2/imgproc.hpp&gt;
#include &lt;Fuzzer/FuzzedDataProvider.h&gt;
#include &lt;fstream&gt;

using namespace cv;
using namespace dnn;

bool saveFile(std::string Path, std::string Content) {
  std::ofstream OFS(Path);
  if (!OFS.is_open())
    return false;

  OFS &lt;&lt; Content;
  return true;
}

static inline void fuzz(FuzzedDataProvider &amp;Provider) {
  auto Input1 = Provider.ConsumeRandomLengthString();
  std::string Input1Path = &quot;input1&quot;;
  if (!saveFile(Input1Path, Input1)) return;
  int Input2 = Provider.ConsumeIntegral&lt;int&gt;();
  auto Input3 = Provider.ConsumeRandomLengthString();
  std::string Input3Path = &quot;input3&quot;;
  if (!saveFile(Input3Path, Input3)) return;
  int Input4 = Provider.ConsumeIntegralInRange&lt;int&gt;(0, 256);
  int Input5 = Provider.ConsumeIntegralInRange&lt;int&gt;(0, 256);
  int Input6 = Provider.ConsumeIntegralInRange&lt;int&gt;(0, 256);
  auto Input7 = Provider.ConsumeRandomLengthString();
  auto Input8 = Provider.ConsumeRandomLengthString();

  Net net;
  net = readNetFromTensorflow(Input1Path);
  if (net.empty())
    return;
  net.setPreferableBackend(Input2);

  Mat sample = imread(Input3Path);
  if (sample.empty())
    return;

  Mat input;
  resize(sample, input, Size(Input4, Input5));
  input -= Scalar::all(Input6);

  Mat inputBlob = blobFromImage(input);

  net.setInput(inputBlob, Input7);
  Mat out = net.forward(Input8);
}

extern &quot;C&quot; int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
  FuzzedDataProvider Provider(data, size);
  try {
    fuzz(Provider);
  } catch (std::exception &amp;E) {}
  return 0;
}"><pre class="notranslate"><code class="notranslate">/*
 * This fuzzer is generated by UTopia project based on TEST(Test_Tensorflow, read_inception).
 * (UTopia Project: https://github.com/Samsung/UTopia)
 */
#include &lt;opencv2/dnn/dnn.hpp&gt;
#include &lt;opencv2/imgcodecs.hpp&gt;
#include &lt;opencv2/imgproc.hpp&gt;
#include &lt;Fuzzer/FuzzedDataProvider.h&gt;
#include &lt;fstream&gt;

using namespace cv;
using namespace dnn;

bool saveFile(std::string Path, std::string Content) {
  std::ofstream OFS(Path);
  if (!OFS.is_open())
    return false;

  OFS &lt;&lt; Content;
  return true;
}

static inline void fuzz(FuzzedDataProvider &amp;Provider) {
  auto Input1 = Provider.ConsumeRandomLengthString();
  std::string Input1Path = "input1";
  if (!saveFile(Input1Path, Input1)) return;
  int Input2 = Provider.ConsumeIntegral&lt;int&gt;();
  auto Input3 = Provider.ConsumeRandomLengthString();
  std::string Input3Path = "input3";
  if (!saveFile(Input3Path, Input3)) return;
  int Input4 = Provider.ConsumeIntegralInRange&lt;int&gt;(0, 256);
  int Input5 = Provider.ConsumeIntegralInRange&lt;int&gt;(0, 256);
  int Input6 = Provider.ConsumeIntegralInRange&lt;int&gt;(0, 256);
  auto Input7 = Provider.ConsumeRandomLengthString();
  auto Input8 = Provider.ConsumeRandomLengthString();

  Net net;
  net = readNetFromTensorflow(Input1Path);
  if (net.empty())
    return;
  net.setPreferableBackend(Input2);

  Mat sample = imread(Input3Path);
  if (sample.empty())
    return;

  Mat input;
  resize(sample, input, Size(Input4, Input5));
  input -= Scalar::all(Input6);

  Mat inputBlob = blobFromImage(input);

  net.setInput(inputBlob, Input7);
  Mat out = net.forward(Input8);
}

extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
  FuzzedDataProvider Provider(data, size);
  try {
    fuzz(Provider);
  } catch (std::exception &amp;E) {}
  return 0;
}
</code></pre></div>
<h5 dir="auto">System information (version)</h5>

<ul dir="auto">
<li>OpenCV =&gt; 3.4.6</li>
<li>Operating System / Platform =&gt; Windows7 64Bit</li>
<li>Compiler =&gt; c++</li>
</ul>
<h5 dir="auto">Detailed description</h5>
<p dir="auto">vs 2015 detect memory leak after cv::resize<br>
without resize, there is no memory leak</p>
<p dir="auto">how I can i fix it?<br>
is there any right way to this code?</p>

<h5 dir="auto">Steps to reproduce</h5>

<p dir="auto">void main()<br>
{<br>
cv::Mat matImg = cv::imread("181031085202_lb-000000_000594_rectified_cam0.jpg");<br>
cv::resize(matImg, matImg, cv::Size(2500 , 3500), 0, 0, cv::INTER_NEAREST);<br>
_CrtDumpMemoryLeaks();<br>
}</p>
<p dir="auto">{794} normal block at 0x0000000002B065F0, 256 bytes long.<br>
Data: &lt;         g      &gt; 00 00 00 00 00 00 00 00 10 67 11 00 00 00 00 00<br>
{793} normal block at 0x0000000000142000, 16 bytes long.<br>
Data: &lt; g              &gt; 80 67 11 00 00 00 00 00 00 00 00 00 00 00 00 00<br>
{792} normal block at 0x0000000000116780, 40 bytes long.<br>
Data: &lt;         e      &gt; 00 20 14 00 00 00 00 00 F0 65 B0 02 00 00 00 00<br>
{791} normal block at 0x0000000000116710, 40 bytes long.<br>
Data: &lt;                &gt; FF FF FF FF 00 00 00 00 00 00 00 00 CD CD CD CD<br>
{782} normal block at 0x0000000002B01890, 256 bytes long.<br>
Data: &lt;        0f      &gt; 00 00 00 00 00 00 00 00 30 66 11 00 00 00 00 00<br>
{781} normal block at 0x0000000000141F60, 16 bytes long.<br>
Data: &lt; f              &gt; A0 66 11 00 00 00 00 00 00 00 00 00 00 00 00 00<br>
{780} normal block at 0x00000000001166A0, 40 bytes long.<br>
Data: &lt;<code class="notranslate">              &gt; 60 1F 14 00 00 00 00 00 90 18 B0 02 00 00 00 00  {779} normal block at 0x0000000000116630, 40 bytes long. Data: &lt;                &gt; FF FF FF FF 00 00 00 00 00 00 00 00 CD CD CD CD  {765} normal block at 0x0000000002AFF380, 256 bytes long. Data: &lt;        Pe      &gt; 00 00 00 00 00 00 00 00 50 65 11 00 00 00 00 00  {764} normal block at 0x0000000000141EC0, 16 bytes long. Data: &lt; e              &gt; C0 65 11 00 00 00 00 00 00 00 00 00 00 00 00 00  {763} normal block at 0x00000000001165C0, 40 bytes long. Data: &lt;                &gt; C0 1E 14 00 00 00 00 00 80 F3 AF 02 00 00 00 00  {762} normal block at 0x0000000000116550, 40 bytes long. Data: &lt;                &gt; FF FF FF FF 00 00 00 00 00 00 00 00 CD CD CD CD  {753} normal block at 0x0000000002AFE650, 256 bytes long. Data: &lt;        pd      &gt; 00 00 00 00 00 00 00 00 70 64 11 00 00 00 00 00  {752} normal block at 0x0000000000141E70, 16 bytes long. Data: &lt; d              &gt; E0 64 11 00 00 00 00 00 00 00 00 00 00 00 00 00  {751} normal block at 0x00000000001164E0, 40 bytes long. Data: &lt;p       P       &gt; 70 1E 14 00 00 00 00 00 50 E6 AF 02 00 00 00 00  {750} normal block at 0x0000000000116470, 40 bytes long. Data: &lt;                &gt; FF FF FF FF 00 00 00 00 00 00 00 00 CD CD CD CD  {739} normal block at 0x0000000002AFD7F0, 256 bytes long. Data: &lt;         c      &gt; 00 00 00 00 00 00 00 00 90 63 11 00 00 00 00 00  {738} normal block at 0x0000000000141DD0, 16 bytes long. Data: &lt; d              &gt; 00 64 11 00 00 00 00 00 00 00 00 00 00 00 00 00  {737} normal block at 0x0000000000116400, 40 bytes long. Data: &lt;                &gt; D0 1D 14 00 00 00 00 00 F0 D7 AF 02 00 00 00 00  {736} normal block at 0x0000000000116390, 40 bytes long. Data: &lt;                &gt; FF FF FF FF 00 00 00 00 00 00 00 00 CD CD CD CD  {703} normal block at 0x0000000002AFBC70, 256 bytes long. Data: &lt;         b      &gt; 00 00 00 00 00 00 00 00 B0 62 11 00 00 00 00 00  {702} normal block at 0x0000000000141C90, 16 bytes long. Data: &lt; c              &gt; 20 63 11 00 00 00 00 00 00 00 00 00 00 00 00 00  {701} normal block at 0x0000000000116320, 40 bytes long. Data: &lt;        p       &gt; 90 1C 14 00 00 00 00 00 70 BC AF 02 00 00 00 00  {700} normal block at 0x00000000001162B0, 40 bytes long. Data: &lt;                &gt; FF FF FF FF 00 00 00 00 00 00 00 00 CD CD CD CD  {699} normal block at 0x0000000002AFBB30, 256 bytes long. Data: &lt;         a      &gt; 00 00 00 00 00 00 00 00 D0 61 11 00 00 00 00 00  {698} normal block at 0x0000000000141C40, 16 bytes long. Data: &lt;@b              &gt; 40 62 11 00 00 00 00 00 00 00 00 00 00 00 00 00  {697} normal block at 0x0000000000116240, 40 bytes long. Data: &lt;@       0       &gt; 40 1C 14 00 00 00 00 00 30 BB AF 02 00 00 00 00  {696} normal block at 0x00000000001161D0, 40 bytes long. Data: &lt;                &gt; FF FF FF FF 00 00 00 00 00 00 00 00 CD CD CD CD  {677} normal block at 0x000000000015FC70, 256 bytes long. Data: &lt;        </code>      &gt; 00 00 00 00 00 00 00 00 F0 60 11 00 00 00 00 00<br>
{676} normal block at 0x0000000000141BA0, 16 bytes long.<br>
Data: &lt;<code class="notranslate">a              &gt; 60 61 11 00 00 00 00 00 00 00 00 00 00 00 00 00  {674} normal block at 0x0000000000116160, 40 bytes long. Data: &lt;        p       &gt; A0 1B 14 00 00 00 00 00 70 FC 15 00 00 00 00 00  {673} normal block at 0x00000000001160F0, 40 bytes long. Data: &lt;                &gt; FF FF FF FF 00 00 00 00 00 00 00 00 CD CD CD CD  {637} normal block at 0x000000000015E5C0, 256 bytes long. Data: &lt;         </code>      &gt; 00 00 00 00 00 00 00 00 10 60 11 00 00 00 00 00<br>
{636} normal block at 0x0000000000141AB0, 16 bytes long.<br>
Data: &lt; <code class="notranslate">              &gt; 80 60 11 00 00 00 00 00 00 00 00 00 00 00 00 00  {635} normal block at 0x0000000000116080, 40 bytes long. Data: &lt;                &gt; B0 1A 14 00 00 00 00 00 C0 E5 15 00 00 00 00 00  {634} normal block at 0x0000000000116010, 40 bytes long. Data: &lt;                &gt; FF FF FF FF 00 00 00 00 00 00 00 00 CD CD CD CD  {633} normal block at 0x0000000002AF6E20, 256 bytes long. Data: &lt;         [      &gt; 00 00 00 00 00 00 00 00 B0 5B 11 00 00 00 00 00  {632} normal block at 0x0000000000141A60, 16 bytes long. Data: &lt; _              &gt; A0 5F 11 00 00 00 00 00 00 00 00 00 00 00 00 00  {631} normal block at 0x0000000000115FA0, 40 bytes long. Data: &lt;</code>        n      &gt; 60 1A 14 00 00 00 00 00 20 6E AF 02 00 00 00 00<br>
{630} normal block at 0x0000000000115BB0, 40 bytes long.<br>
Data: &lt;                &gt; FF FF FF FF 00 00 00 00 00 00 00 00 CD CD CD CD</p>
<p dir="auto">---------------------below is cause of dll load<br>
{395} normal block at 0x0000000000119320, 16 bytes long.<br>
Data: &lt;                &gt; 08 92 11 00 00 00 00 00 00 00 00 00 00 00 00 00<br>
{393} normal block at 0x0000000000106CA0, 4 bytes long.<br>
Data: &lt;    &gt; 00 00 00 00<br>
...</p>