From 773262bc098322f3e603dc6abe06de85240f1f66 Mon Sep 17 00:00:00 2001
From: Federico Martinez <federico.martinez@advertima.com>
Date: Tue, 23 Feb 2021 08:44:17 +0100
Subject: [PATCH] Fix UB in CopyMakeConstBoder_8u

Caused by overflow of arithmetic operators conversion rank
---
 modules/core/src/copy.cpp | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/modules/core/src/copy.cpp b/modules/core/src/copy.cpp
index dcd585d834..798fde74d4 100644
--- a/modules/core/src/copy.cpp
+++ b/modules/core/src/copy.cpp
@@ -1325,13 +1325,12 @@ void copyMakeConstBorder_8u( const uchar* src, size_t srcstep, cv::Size srcroi,
         memcpy( dstInner + srcroi.width, constBuf, right );
     }
 
-    dst += dststep*top;
-
     for( i = 0; i < top; i++ )
-        memcpy(dst + (i - top)*dststep, constBuf, dstroi.width);
+        memcpy(dst + i * dststep, constBuf, dstroi.width);
 
+    dst += (top + srcroi.height) * dststep;
     for( i = 0; i < bottom; i++ )
-        memcpy(dst + (i + srcroi.height)*dststep, constBuf, dstroi.width);
+        memcpy(dst + i * dststep, constBuf, dstroi.width);
 }
 
 }
-- 
GitLab