mirror of
https://github.com/opencv/opencv.git
synced 2026-07-25 21:33:04 +04:00
arshsmith
de90d1aec4
Follow-up to the recent "reject under-length raw exif profile" change. The declared length in a PNG raw exif profile (tEXt/zTXt "Raw profile type exif" chunk) is fully attacker controlled. The < 6 guard stops the underflow, but a large positive value still passes it and reaches HexStringToBytes(), which does raw_data.resize(expected_length) before reading anything. So a few bytes in a text chunk can force a ~2GB allocation -> easy memory-amplification DoS while decoding an otherwise small PNG. The payload is hex encoded (two characters per byte), so a valid length can never exceed the profile text carrying it. Reject any declared length greater than profile_len. This bounds the allocation to the input size and doesn't reject any valid profile; the valid decode path is unchanged.