From 845616d82cae8d8865f1eb4ee032a7b8e0db3f26 Mon Sep 17 00:00:00 2001
From: Vincent Rabaud <vrabaud@google.com>
Date: Thu, 2 Jan 2025 14:39:54 +0100
Subject: [PATCH] Fix integer overflow in in cv::BmpDecoder::readHeader

Bug: oss-fuzz:371546812
---
 modules/imgcodecs/src/grfmt_bmp.cpp | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/modules/imgcodecs/src/grfmt_bmp.cpp b/modules/imgcodecs/src/grfmt_bmp.cpp
index e69a93c78b..a8ca6a046a 100644
--- a/modules/imgcodecs/src/grfmt_bmp.cpp
+++ b/modules/imgcodecs/src/grfmt_bmp.cpp
@@ -208,7 +208,12 @@ bool  BmpDecoder::readHeader()
     // in 32 bit case alpha channel is used - so require CV_8UC4 type
     m_type = iscolor ? ((m_bpp == 32 && m_rle_code != BMP_RGB) ? CV_8UC4 : CV_8UC3 ) : CV_8UC1;
     m_origin = m_height > 0 ? ORIGIN_BL : ORIGIN_TL;
-    m_height = std::abs(m_height);
+    if ( m_height == std::numeric_limits<int>::min() ) {
+        // abs(std::numeric_limits<int>::min()) is undefined behavior.
+        result = false;
+    } else {
+        m_height = std::abs(m_height);
+    }
 
     if( !result )
     {