From a89aa8c90a625c78e40f4288d145996d9cda3599 Mon Sep 17 00:00:00 2001 From: Vincent Rabaud Date: Wed, 21 Sep 2016 16:30:31 +0200 Subject: [PATCH] Fix imageSize overflow in IplImage --- modules/core/src/array.cpp | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/modules/core/src/array.cpp b/modules/core/src/array.cpp index 5eacb0eb3f..d22f9c2c24 100644 --- a/modules/core/src/array.cpp +++ b/modules/core/src/array.cpp @@ -834,6 +834,9 @@ cvCreateData( CvArr* arr ) if( !CvIPL.allocateData ) { + const int64 imageSize_tmp = (int64)img->widthStep*(int64)img->height; + if( (int64)img->imageSize != imageSize_tmp ) + CV_Error( CV_StsNoMem, "Overflow for imageSize" ); img->imageData = img->imageDataOrigin = (char*)cvAlloc( (size_t)img->imageSize ); } @@ -941,7 +944,10 @@ cvSetData( CvArr* arr, void* data, int step ) img->widthStep = min_step; } - img->imageSize = img->widthStep * img->height; + const int64 imageSize_tmp = (int64)img->widthStep*(int64)img->height; + img->imageSize = (int)imageSize_tmp; + if( (int64)img->imageSize != imageSize_tmp ) + CV_Error( CV_StsNoMem, "Overflow for imageSize" ); img->imageData = img->imageDataOrigin = (char*)data; if( (((int)(size_t)data | step) & 7) == 0 && @@ -2958,7 +2964,10 @@ cvInitImageHeader( IplImage * image, CvSize size, int depth, image->widthStep = (((image->width * image->nChannels * (image->depth & ~IPL_DEPTH_SIGN) + 7)/8)+ align - 1) & (~(align - 1)); image->origin = origin; - image->imageSize = image->widthStep * image->height; + const int64 imageSize_tmp = (int64)image->widthStep*(int64)image->height; + image->imageSize = (int)imageSize_tmp; + if( (int64)image->imageSize != imageSize_tmp ) + CV_Error( CV_StsNoMem, "Overflow for imageSize" ); return image; }