mirror of
https://github.com/opencv/opencv.git
synced 2026-09-12 05:11:04 -05:00
7a25b1986d
The 16-bit icvCvt_* helpers in utils.cpp advance the row pointer with step/sizeof(x[0]) - size.width*N at the end of each row. sizeof is size_t (unsigned), so the whole subtraction is done in unsigned math and wraps to a huge offset when the caller passes step == 0. The TIFF tile decoder does exactly that: it walks rows itself and calls these helpers with step = 0 and Size(width, 1), so decoding a 16-bit 4-channel TIFF forms an out of range pointer. UBSan reports it as an unsigned offset overflow (issue #29615). Cast sizeof(...) to int so the step math is signed. The result is the same for valid multi-row calls and no longer overflows when step is 0. Added Imgcodecs_Tiff.regression_29615_16UC4 which round-trips a CV_16UC4 TIFF in memory.