Commit5c6c584

committed

Prevent integer overflow in dimension checks.

1 parentc037344 commit5c6c584Copy full SHA for 5c6c584

File tree

-2

lines changed

-2

lines changed

Lines changed: 3 additions & 2 deletions

Original file line number	Diff line number	Diff line change
`@@ -42,6 +42,7 @@`
`42`	`42`
`43`	`43`	`#include"precomp.hpp"`
`44`	`44`
	`45`	`+#include<cstdint>`
`45`	`46`	`#include<memory>`
`46`	`47`
`47`	`48`	`#ifdef HAVE_PNG`
`@@ -364,7 +365,7 @@ bool PngDecoder::readHeader()`
`364`	`365`	`m_color_type = color_type;`
`365`	`366`	`m_bit_depth = bit_depth;`
`366`	`367`
`367`		`-if (m_is_fcTL_loaded && ((longlongint)x0 + w0 > m_width \|\| (longlongint)y0 + h0 > m_height \|\| dop >2 \|\| bop >1))`
	`368`	`+if (m_is_fcTL_loaded && ((int64_t)x0 + w0 > m_width \|\| (int64_t)y0 + h0 > m_height \|\| dop >2 \|\| bop >1))`
`368`	`369`	`returnfalse;`
`369`	`370`
`370`	`371`	`png_color_16p background_color;`
`@@ -456,7 +457,7 @@ bool PngDecoder::readData( Mat& img )`
`456`	`457`	`if (dop ==2)`
`457`	`458`	`memcpy(frameNext.getPixels(), frameCur.getPixels(), imagesize);`
`458`	`459`
`459`		`-if (x0 + w0 > frameCur.getWidth() \|\| y0 + h0 > frameCur.getHeight())`
	`460`	`+if ((uint64_t)x0 + w0 > frameCur.getWidth() \|\|(uint64_t)y0 + h0 > frameCur.getHeight())`
`460`	`461`	`returnfalse;`
`461`	`462`
`462`	`463`	`compose_frame(frameCur.getRows(), frameRaw.getRows(), bop, x0, y0, w0, h0, mat_cur);`

Comments

(0)