mirror of
https://github.com/opencv/opencv.git
synced 2026-09-11 04:43:22 -05:00
b7860407f0
The 16-bit icvCvt_* helpers in utils.cpp move the row pointer with step/sizeof(x[0]) - size.width*N. sizeof is unsigned, so this is done in unsigned math. When the caller passes step == 0, it underflows to a huge value and the pointer goes out of range, which is undefined behavior. The TIFF decoder hits this: it walks rows itself and calls these helpers with step = 0, so reading a 16-bit 4-channel TIFF triggers the bug. Cast sizeof(...) to int so the math is signed. Same result for normal calls, no overflow when the step is 0. Added Imgcodecs_Tiff.regression_29615_16UC4 which round-trips a CV_16UC4 TIFF in memory. This is the 4.x version of the fix, requested in https://github.com/opencv/opencv/pull/29620 (issue #29615).