From f7856a0f35ec9ff33077fc49804864707fb782d4 Mon Sep 17 00:00:00 2001 From: Alexander Alekhin Date: Sat, 20 Apr 2019 20:09:33 +0000 Subject: [PATCH] imgcodecs(tiff): update tile size checks backporting of commit: 25247b9f6e5e550868262b7611a9e575c1f7212a --- modules/imgcodecs/src/grfmt_tiff.cpp | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/modules/imgcodecs/src/grfmt_tiff.cpp b/modules/imgcodecs/src/grfmt_tiff.cpp index 2094b1accc..a604423c62 100644 --- a/modules/imgcodecs/src/grfmt_tiff.cpp +++ b/modules/imgcodecs/src/grfmt_tiff.cpp @@ -401,9 +401,14 @@ bool TiffDecoder::readData( Mat& img ) (!is_tiled && tile_height0 == std::numeric_limits::max()) ) tile_height0 = m_height; - CV_Assert((int)tile_width0 > 0 && (int)tile_width0 < std::numeric_limits::max()); - CV_Assert((int)tile_height0 > 0 && (int)tile_height0 < std::numeric_limits::max()); - CV_Assert(((uint64_t)tile_width0 * tile_height0 * ncn * (bpp / bitsPerByte) < (CV_BIG_UINT(1) << 30)) && "TIFF tile size is too large: >= 1Gb"); + const int TILE_MAX_WIDTH = (1 << 24); + const int TILE_MAX_HEIGHT = (1 << 24); + CV_Assert((int)tile_width0 > 0 && (int)tile_width0 <= TILE_MAX_WIDTH); + CV_Assert((int)tile_height0 > 0 && (int)tile_height0 <= TILE_MAX_HEIGHT); + const uint64_t MAX_TILE_SIZE = (CV_BIG_UINT(1) << 30); + CV_CheckLE((int)ncn, 4, ""); + CV_CheckLE((int)bpp, 64, ""); + CV_Assert(((uint64_t)tile_width0 * tile_height0 * ncn * std::max(1, (int)(bpp / bitsPerByte)) < MAX_TILE_SIZE) && "TIFF tile size is too large: >= 1Gb"); if (dst_bpp == 8) {