diff --git a/modules/imgcodecs/src/bitstrm.cpp b/modules/imgcodecs/src/bitstrm.cpp
index 544305c312..a11697264b 100644
--- a/modules/imgcodecs/src/bitstrm.cpp
+++ b/modules/imgcodecs/src/bitstrm.cpp
@@ -42,6 +42,7 @@
 
 #include "precomp.hpp"
 #include "bitstrm.hpp"
+#include "utils.hpp"
 
 namespace cv
 {
@@ -183,13 +184,18 @@ void  RBaseStream::setPos( int pos )
 int  RBaseStream::getPos()
 {
     CV_Assert(isOpened());
-    return m_block_pos + (int)(m_current - m_start);
+    int pos = validateToInt((m_current - m_start) + m_block_pos);
+    CV_Assert(pos >= m_block_pos); // overflow check
+    CV_Assert(pos >= 0); // overflow check
+    return pos;
 }
 
 void  RBaseStream::skip( int bytes )
 {
     CV_Assert(bytes >= 0);
+    uchar* old = m_current;
     m_current += bytes;
+    CV_Assert(m_current >= old);  // overflow check
 }
 
 /////////////////////////  RLByteStream ////////////////////////////
diff --git a/modules/imgcodecs/src/grfmt_bmp.cpp b/modules/imgcodecs/src/grfmt_bmp.cpp
index ab46219aa0..25a386eaeb 100644
--- a/modules/imgcodecs/src/grfmt_bmp.cpp
+++ b/modules/imgcodecs/src/grfmt_bmp.cpp
@@ -95,6 +95,7 @@ bool  BmpDecoder::readHeader()
         m_offset = m_strm.getDWord();
 
         int  size = m_strm.getDWord();
+        CV_Assert(size > 0); // overflow, 2Gb limit
 
         if( size >= 36 )
         {