diff --git a/modules/imgcodecs/src/grfmt_png.cpp b/modules/imgcodecs/src/grfmt_png.cpp index e8b5fcedd4..dedc9be515 100644 --- a/modules/imgcodecs/src/grfmt_png.cpp +++ b/modules/imgcodecs/src/grfmt_png.cpp @@ -655,7 +655,7 @@ size_t PngDecoder::read_from_io(void* _Buffer, size_t _ElementSize, size_t _Elem if (m_f) return fread(_Buffer, _ElementSize, _ElementCount, m_f); - if (m_buf_pos > m_buf.cols * m_buf.rows * m_buf.elemSize()) + if (m_buf_pos + _ElementSize > m_buf.cols * m_buf.rows * m_buf.elemSize()) CV_Error(Error::StsInternal, "PNG input buffer is incomplete"); memcpy( _Buffer, m_buf.ptr() + m_buf_pos, _ElementSize );