mirror of
https://github.com/opencv/opencv.git
synced 2026-07-29 07:13:02 +04:00
arshsmith
de90d1aec4
Follow-up to the recent "reject under-length raw exif profile" change. The declared length in a PNG raw exif profile (tEXt/zTXt "Raw profile type exif" chunk) is fully attacker controlled. The < 6 guard stops the underflow, but a large positive value still passes it and reaches HexStringToBytes(), which does raw_data.resize(expected_length) before reading anything. So a few bytes in a text chunk can force a ~2GB allocation -> easy memory-amplification DoS while decoding an otherwise small PNG. The payload is hex encoded (two characters per byte), so a valid length can never exceed the profile text carrying it. Reject any declared length greater than profile_len. This bounds the allocation to the input size and doesn't reject any valid profile; the valid decode path is unchanged.
OpenCV: Open Source Computer Vision Library
Resources
- Homepage: https://opencv.org
- Courses: https://opencv.org/courses
- Docs: https://docs.opencv.org/4.x/
- Q&A forum: https://forum.opencv.org
- previous forum (read only): http://answers.opencv.org
- Issue tracking: https://github.com/opencv/opencv/issues
- Additional OpenCV functionality: https://github.com/opencv/opencv_contrib
- Donate to OpenCV: https://opencv.org/support/
Contributing
Please read the contribution guidelines before starting work on a pull request.
Summary of the guidelines:
- One pull request per issue;
- Choose the right base branch;
- Include tests and documentation;
- Clean up "oops" commits before submitting;
- Follow the coding style guide.
Additional Resources
- Submit your OpenCV-based project for inclusion in Community Friday on opencv.org
- Subscribe to the OpenCV YouTube Channel featuring OpenCV Live, an hour-long streaming show
- Follow OpenCV on LinkedIn for daily posts showing the state-of-the-art in computer vision & AI
- Apply to be an OpenCV Volunteer to help organize events and online campaigns as well as amplify them
- Follow OpenCV on Mastodon in the Fediverse
- Follow OpenCV on Twitter
- OpenCV.ai: Computer Vision and AI development services from the OpenCV team.