From fe61ae0e4108c5c5a4e7db99ccb277814cfb3d90 Mon Sep 17 00:00:00 2001 From: uwezkhan Date: Tue, 9 Jun 2026 10:09:52 +0530 Subject: [PATCH] cap torch storage size to int to prevent heap overflow --- modules/dnn/src/torch/torch_importer.cpp | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/modules/dnn/src/torch/torch_importer.cpp b/modules/dnn/src/torch/torch_importer.cpp index bfd01a0bb3..d13461b94a 100644 --- a/modules/dnn/src/torch/torch_importer.cpp +++ b/modules/dnn/src/torch/torch_importer.cpp @@ -255,6 +255,10 @@ struct TorchImporter void readTorchStorage(int index, int type = -1) { long size = readLong(); + // size is read as a 64-bit value but Mat::create() takes int columns, so a + // value above INT_MAX is truncated for the allocation while the THFile_read*Raw + // calls below still consume the full 64-bit count, overflowing the buffer. + CV_Assert(size >= 0 && size <= INT_MAX); Mat storageMat; switch (type)