From 19ec7ea28b7209c0a1c34cb559b37b56774864a5 Mon Sep 17 00:00:00 2001 From: uwezkhan Date: Sat, 13 Jun 2026 15:04:24 +0530 Subject: [PATCH] reject under-length raw exif profile in processRawProfile --- modules/imgcodecs/src/exif.cpp | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/modules/imgcodecs/src/exif.cpp b/modules/imgcodecs/src/exif.cpp index 5484031c50..23b080b1e0 100644 --- a/modules/imgcodecs/src/exif.cpp +++ b/modules/imgcodecs/src/exif.cpp @@ -160,6 +160,12 @@ bool ExifReader::processRawProfile(const char* profile, size_t profile_len) { } ++end; + // the payload starts with a 6-byte "Exif\0\0" header, so a shorter declared + // length underflows the size and pointer handed to parseExif() below + if (expected_length < 6) { + return false; + } + // 'end' now points to the profile payload. std::string payload = HexStringToBytes(end, expected_length); if (payload.size() == 0) return false;