From deaf58689a4573b0414e88ff307d0250417851ff Mon Sep 17 00:00:00 2001 From: Vincent Rabaud Date: Thu, 10 Jul 2025 15:05:56 +0200 Subject: [PATCH] Fix potential crashes found by fuzzer. Namely 429429085, 429645379, 430091585 --- modules/imgcodecs/src/grfmt_png.cpp | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/modules/imgcodecs/src/grfmt_png.cpp b/modules/imgcodecs/src/grfmt_png.cpp index f0f656bd25..c78c0efc55 100644 --- a/modules/imgcodecs/src/grfmt_png.cpp +++ b/modules/imgcodecs/src/grfmt_png.cpp @@ -455,6 +455,9 @@ bool PngDecoder::readData( Mat& img ) if (dop == 2) memcpy(frameNext.getPixels(), frameCur.getPixels(), imagesize); + if (x0 + w0 > frameCur.getWidth() || y0 + h0 > frameCur.getHeight()) + return false; + compose_frame(frameCur.getRows(), frameRaw.getRows(), bop, x0, y0, w0, h0, mat_cur); if (!delay_den) delay_den = 100; @@ -849,6 +852,8 @@ void PngDecoder::row_fn(png_structp png_ptr, png_bytep new_row, png_uint_32 row_ { CV_UNUSED(pass); APNGFrame* frame = (APNGFrame*)png_get_progressive_ptr(png_ptr); + if(row_num >= frame->getHeight()) + return; png_progressive_combine_row(png_ptr, frame->getRows()[row_num], new_row); }