Hacktoberfest 2026：维护者为十月标记出来的 issue，仍然开放、适合新手。 浏览 Hacktoberfest issue

cv2 import appends a trailing ":" to LD_LIBRARY_PATH — empty entry resolves to CWD and breaks child processes

未关闭
  • 哪里不对？
#1,268 1 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

还没有人认领这个 Issue。

评估

难度
3/5
预计耗时
1-2 天
新手友好度
70/100
Issue 类型
缺陷
描述清晰度
基本清楚
活跃度
活跃
技术栈
linux, python
领域
build-system, operating-systems

调研方向

运行最小复现，然后检查 cv2/init.py 中第 146-147 行附近的 POSIX 分支，并跟踪 BINARIES_PATHS 的使用方式。完成的标准是，导入 cv2 不再创建空的 LD_LIBRARY_PATH 条目，也不再导致无关的子进程继承不安全的路径；如果仓库提供了合适的测试位置，请添加回归测试覆盖。

由索引模型根据 Issue 内容生成。

描述

Environment
  • opencv-python: reproduced on 4.11.0.86, 4.12.0.88, 4.13.0.92, 4.14.0.94 and 5.0.0.93 (PyPI manylinux x86_64 wheels; earliest tested 4.11.0.86, Jan 2025)
  • Python 3.13.15 / 3.14.7, Linux x86_64 (glibc; CachyOS/Arch, kernel 6.x)
Minimal reproduction
python -m venv venv && venv/bin/pip install opencv-python==5.0.0.93
venv/bin/python - <<'EOF'
import os, subprocess

print("before import:", repr(os.environ.get("LD_LIBRARY_PATH")))
import cv2
print("cv2", cv2.__version__, "after import:", repr(os.environ.get("LD_LIBRARY_PATH")))
print("child sees:", subprocess.run(["sh", "-c", "printf '%s' \"$LD_LIBRARY_PATH\""],
      capture_output=True, text=True).stdout)
EOF
Observed
before import: None
cv2 5.0.0 after import: '/…/site-packages/cv2/../../lib64:'
child sees: '/…/site-packages/cv2/../../lib64:'

cv2/__init__.py (POSIX branch, cv2/__init__.py:146-147 in current wheels):

# amending of LD_LIBRARY_PATH works for sub-processes only
os.environ['LD_LIBRARY_PATH'] = ':'.join(l_vars['BINARIES_PATHS']) + ':' + os.environ.get('LD_LIBRARY_PATH', '')

Three problems in one line:

  1. Unconditional trailing : — when LD_LIBRARY_PATH was previously unset the
    variable is created with a dangling separator. Per ld.so(8) semantics an empty
    entry resolves to the current working directory of every child process.
  2. Global environment mutation — the comment itself notes this "works for
    sub-processes only", yet the write persists in os.environ for the whole
    process lifetime, so every subprocess/os.system/webbrowser call made by
    the host application inherits the modified path. This is invisible side-channel
    state an importer cannot reasonably expect from import cv2.
  3. The injected directory typically does not exist — with standard manylinux
    wheel layouts the bundled libraries live in opencv_python.libs/ (located via
    $ORIGIN RPATH), and <site-packages>/cv2/../../lib64 is absent in venv,
    project, and standalone-packaged layouts, so the write buys nothing while
    adding the hazard.
Real-world impact

We ship a Nuitka-standalone application whose launcher cds into the release
folder. With cv2 imported, LD_LIBRARY_PATH ends with : → the release folder
(the CWD) enters the child loader path → children that load system OpenSSL
(xdg-open → kde-open, i.e. "open a URL in the default browser") resolve the
bundled, older libssl.so.3/libcrypto.so.3 instead of the system ones and die
with:

kde-open: libssl.so.3: version `OPENSSL_3.2.0' not found (required by /usr/lib/libcurl.so.4)

Any application that imports cv2 and then spawns helper processes from a
directory containing same-named libraries is affected the same way.

Suggested fix

  • Do not append a dangling separator; only write the variable when there is
    something to add and prepend/append with proper joining:

    paths = l_vars['BINARIES_PATHS']
if paths:
    old = os.environ.get('LD_LIBRARY_PATH')
    os.environ['LD_LIBRARY_PATH'] = ':'.join(paths) + (':' + old if old else '')

  • Longer term, prefer not mutating the global environment at all: the bundled
    libraries are already found through $ORIGIN RPATH; if an env-based fallback
    is really needed, consider documenting it and cleaning up after import, or
    exposing an opt-in.

Happy to send a PR to opencv-python/opencv-python (the loader __init__.py)
if you agree with the direction.

主要语言
Python
星标
5.4k
派生
1k
平均合并
22 小时 17 分钟
30 天内合并 PR
3

环境准备

  • 没有 Dockerfile 或 Docker Compose 文件
  • 没有 Pull Request 模板
  • 阅读贡献指南

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

opencv/opencv-python 的其他 Issue

查看 opencv/opencv-python 的全部 Issue

相似的 Issue

更多 Python Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。