mirror of
https://github.com/opencv/opencv.git
synced 2026-07-29 15:23:05 +04:00
Murat Raimbekov
c7729066c4
imgcodecs: fix integer overflow in BMP and SunRaster decoders #28379 ### Pull Request Readiness Checklist - [x] I agree to contribute to the project under Apache 2 License. - [x] To the best of my knowledge, the proposed patch is not based on a code under GPL or another license that is incompatible with OpenCV - [x] The PR is proposed to the proper branch - [x] There is a reference to the original bug report and related work - [ ] There is accuracy test, performance test and test data in opencv_extra repository, if applicable Patch to opencv_extra has the same branch name. - [ ] The feature is well documented and sample code can be built with the project CMake Fixes #28350 ### Description This PR fixes integer overflow vulnerabilities in BMP and SunRaster image decoders that could cause heap buffer over-read when decoding malformed images. ### Root Cause The `src_pitch` and `width3` calculations in `BmpDecoder::readData()` and `SunRasterDecoder::readData()` used `int` arithmetic: ```cpp int src_pitch = ((m_width * m_bpp + 7) / 8 + 3) & -4; int width3 = m_width * nch; ``` When `m_width` or `m_bpp` are large values from a crafted malicious file, the multiplication overflows, resulting in a small or negative value. This leads to insufficient buffer allocation, causing heap buffer over-read during subsequent decoding operations. ### Fix 1. **Use `size_t` arithmetic**: Cast operands to `size_t` before multiplication: ```cpp const size_t bits_per_row = static_cast<size_t>(m_width) * static_cast<size_t>(m_bpp); const size_t src_pitch_size = ((bits_per_row + 7) / 8 + 3) & ~static_cast<size_t>(3); ``` 2. **Add size validation**: Added `CV_CheckLT` to reject images requiring buffers larger than 256MB: ```cpp const size_t MAX_SRC_PITCH = static_cast<size_t>(1) << 28; CV_CheckLT(src_pitch_size, MAX_SRC_PITCH, "BMP: src_pitch exceeds maximum allowed size"); ``` 3. **Safe conversion**: Use `validateToInt()` for safe conversion back to `int`. ### Files Changed - `modules/imgcodecs/src/grfmt_bmp.cpp` - BmpDecoder::readData() - `modules/imgcodecs/src/grfmt_sunras.cpp` - SunRasterDecoder::readData() ### Testing - Code compiles without warnings - Basic BMP and SunRaster encode/decode tests pass - Overflow conditions are now properly rejected with CV_CheckLT
OpenCV: Open Source Computer Vision Library
Resources
- Homepage: https://opencv.org
- Courses: https://opencv.org/courses
- Docs: https://docs.opencv.org/4.x/
- Q&A forum: https://forum.opencv.org
- previous forum (read only): http://answers.opencv.org
- Issue tracking: https://github.com/opencv/opencv/issues
- Additional OpenCV functionality: https://github.com/opencv/opencv_contrib
- Donate to OpenCV: https://opencv.org/support/
Contributing
Please read the contribution guidelines before starting work on a pull request.
Summary of the guidelines:
- One pull request per issue;
- Choose the right base branch;
- Include tests and documentation;
- Clean up "oops" commits before submitting;
- Follow the coding style guide.
Additional Resources
- Submit your OpenCV-based project for inclusion in Community Friday on opencv.org
- Subscribe to the OpenCV YouTube Channel featuring OpenCV Live, an hour-long streaming show
- Follow OpenCV on LinkedIn for daily posts showing the state-of-the-art in computer vision & AI
- Apply to be an OpenCV Volunteer to help organize events and online campaigns as well as amplify them
- Follow OpenCV on Mastodon in the Fediverse
- Follow OpenCV on Twitter
- OpenCV.ai: Computer Vision and AI development services from the OpenCV team.