From 12963ea6995fa7dbf6a113038a6a6fd920b0e588 Mon Sep 17 00:00:00 2001 From: Vincent Rabaud Date: Thu, 2 Jan 2025 14:51:20 +0100 Subject: [PATCH] Fix heap buffer overflow in cv::PngDecoder::read_from_io Bug: oss-fuzz:386688710 --- modules/imgcodecs/src/grfmt_png.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/imgcodecs/src/grfmt_png.cpp b/modules/imgcodecs/src/grfmt_png.cpp index 32620fdbc0..eba0226d0e 100644 --- a/modules/imgcodecs/src/grfmt_png.cpp +++ b/modules/imgcodecs/src/grfmt_png.cpp @@ -655,7 +655,7 @@ size_t PngDecoder::read_from_io(void* _Buffer, size_t _ElementSize, size_t _Elem if (m_f) return fread(_Buffer, _ElementSize, _ElementCount, m_f); - if (m_buf_pos > m_buf.cols * m_buf.rows * m_buf.elemSize()) + if (m_buf_pos + _ElementSize > m_buf.cols * m_buf.rows * m_buf.elemSize()) CV_Error(Error::StsInternal, "PNG input buffer is incomplete"); memcpy( _Buffer, m_buf.ptr() + m_buf_pos, _ElementSize );