Fix integer overflow in in cv::BmpDecoder::readHeader

Bug: oss-fuzz:371546812
sergiogallegos · Jan 3, 2025 · 845616d · 845616d
1 parent 5e1eed5
commit 845616d
Showing 1 changed file with 6 additions and 1 deletion.
diff --git a/modules/imgcodecs/src/grfmt_bmp.cpp b/modules/imgcodecs/src/grfmt_bmp.cpp
@@ -208,7 +208,12 @@ bool  BmpDecoder::readHeader()
     // in 32 bit case alpha channel is used - so require CV_8UC4 type
     m_type = iscolor ? ((m_bpp == 32 && m_rle_code != BMP_RGB) ? CV_8UC4 : CV_8UC3 ) : CV_8UC1;
     m_origin = m_height > 0 ? ORIGIN_BL : ORIGIN_TL;
-    m_height = std::abs(m_height);
+    if ( m_height == std::numeric_limits<int>::min() ) {
+        // abs(std::numeric_limits<int>::min()) is undefined behavior.
+        result = false;
+    } else {
+        m_height = std::abs(m_height);
+    }
 
     if( !result )
     {