diff --git a/modules/dnn/src/torch/torch_importer.cpp b/modules/dnn/src/torch/torch_importer.cpp index bfd01a0bb3..d13461b94a 100644 --- a/modules/dnn/src/torch/torch_importer.cpp +++ b/modules/dnn/src/torch/torch_importer.cpp @@ -255,6 +255,10 @@ struct TorchImporter void readTorchStorage(int index, int type = -1) { long size = readLong(); + // size is read as a 64-bit value but Mat::create() takes int columns, so a + // value above INT_MAX is truncated for the allocation while the THFile_read*Raw + // calls below still consume the full 64-bit count, overflowing the buffer. + CV_Assert(size >= 0 && size <= INT_MAX); Mat storageMat; switch (type)