1
0
mirror of https://github.com/opencv/opencv.git synced 2026-07-30 15:53:03 +04:00

Merge pull request #27138 from vrabaud:lzw

Fix heap buffer overflow and use after free in imgcodecs #27138

This fixes:
- https://g-issues.oss-fuzz.com/issues/405243132
- https://g-issues.oss-fuzz.com/issues/405456349

### Pull Request Readiness Checklist

See details at https://github.com/opencv/opencv/wiki/How_to_contribute#making-a-good-pull-request

- [x] I agree to contribute to the project under Apache 2 License.
- [x] To the best of my knowledge, the proposed patch is not based on a code under GPL or another license that is incompatible with OpenCV
- [x] The PR is proposed to the proper branch
- [x] There is a reference to the original bug report and related work
- [ ] There is accuracy test, performance test and test data in opencv_extra repository, if applicable
      Patch to opencv_extra has the same branch name.
- [ ] The feature is well documented and sample code can be built with the project CMake
This commit is contained in:
Vincent Rabaud
2025-03-26 15:14:50 +01:00
committed by GitHub
parent 8e2826ddd6
commit 42a132088c
2 changed files with 35 additions and 18 deletions
+2
View File
@@ -392,6 +392,8 @@ bool GifDecoder::lzwDecode() {
if (code < colorTableSize) {
imgCodeStream[idx++] = (uchar)code;
} else {
CV_LOG_WARNING(NULL, "Too long LZW length in GIF.");
CV_Assert(idx + lzwExtraTable[code].length <= width * height);
for (int i = 0; i < lzwExtraTable[code].length - 1; i++) {
imgCodeStream[idx++] = lzwExtraTable[code].prefix[i];
}