Merge pull request opencv#9915 from alalek:backport_9903

alalek · web-flow · commit e15a56d14290 · 2017-10-26T12:19:38.000+03:00
(2.4) Backport opencv#9903: Fix out of bounds write
diff --git a/modules/highgui/src/grfmt_bmp.cpp b/modules/highgui/src/grfmt_bmp.cpp
@@ -115,7 +115,7 @@ bool  BmpDecoder::readHeader()
 
                 if( m_bpp <= 8 )
                 {
-                    CV_Assert(clrused <= 256);
+                    CV_Assert(clrused >= 0 && clrused <= 256);
                     memset(m_palette, 0, sizeof(m_palette));
                     m_strm.getBytes(m_palette, (clrused == 0? 1<<m_bpp : clrused)*4 );
                     iscolor = IsColorPalette( m_palette, m_bpp );

Original file line number	Diff line number	Diff line change
`@@ -115,7 +115,7 @@ bool BmpDecoder::readHeader()`
`115`	`115`
`116`	`116`	`if( m_bpp <= 8 )`
`117`	`117`	`{`
`118`		`- CV_Assert(clrused <= 256);`
	`118`	`+ CV_Assert(clrused >= 0 && clrused <= 256);`
`119`	`119`	`memset(m_palette, 0, sizeof(m_palette));`
`120`	`120`	`m_strm.getBytes(m_palette, (clrused == 0? 1<<m_bpp : clrused)*4 );`
`121`	`121`	`iscolor = IsColorPalette( m_palette, m_bpp );`