From c5f6ed6fef9cd61b69364a50bba0391265c5a74a Mon Sep 17 00:00:00 2001
From: Vincent Rabaud <vrabaud@google.com>
Date: Mon, 27 Jan 2025 09:58:07 +0100
Subject: [PATCH] Fix overlow pointers.

`step` and `maskStep` are used to increase/decrease `pImage`.
But it's done on unsigned type, relying on overflow, which is UB.
(step is size_t but seed.y is int and can be negative, the result
is therefore unsigned which can overflow)
---
 modules/imgproc/src/floodfill.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/imgproc/src/floodfill.cpp b/modules/imgproc/src/floodfill.cpp
index 273f220bb0..5ef019fb0f 100644
--- a/modules/imgproc/src/floodfill.cpp
+++ b/modules/imgproc/src/floodfill.cpp
@@ -283,7 +283,7 @@ floodFillGrad_CnIR( Mat& image, Mat& msk,
                    Diff diff, ConnectedComp* region, int flags,
                    std::vector<FFillSegment>* buffer )
 {
-    size_t step = image.step, maskStep = msk.step;
+    auto step = static_cast<std::ptrdiff_t>(image.step), maskStep = static_cast<std::ptrdiff_t>(msk.step);
     uchar* pImage = image.ptr();
     _Tp* img = (_Tp*)(pImage + step*seed.y);
     uchar* pMask = msk.ptr() + maskStep + sizeof(_MTp);