Fix heap buffer overflow in cv::PngDecoder::read_from_io

Bug: oss-fuzz:386688710
2 months ago · 12963ea699
parent 4d26e16af8
commit 12963ea699
1 changed files with 1 additions and 1 deletions
--- a/modules/imgcodecs/src/grfmt_png.cpp
+++ b/modules/imgcodecs/src/grfmt_png.cpp
@ -655,7 +655,7 @@ size_t PngDecoder::read_from_io(void* _Buffer, size_t _ElementSize, size_t _Elem
    if (m_f)
        return fread(_Buffer, _ElementSize, _ElementCount, m_f);

-    if (m_buf_pos > m_buf.cols * m_buf.rows * m_buf.elemSize())
+    if (m_buf_pos + _ElementSize > m_buf.cols * m_buf.rows * m_buf.elemSize())
        CV_Error(Error::StsInternal, "PNG input buffer is incomplete");

    memcpy( _Buffer, m_buf.ptr() + m_buf_pos, _ElementSize );