Skip to content

Commit 0df5490

Browse files
committed
SA79000 advisory fix
1 parent 21da3cd commit 0df5490

File tree

4 files changed

+105
-6
lines changed

4 files changed

+105
-6
lines changed

Diff for: Changelog.txt

+8-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,11 @@
1-
Alex Tutubalin <lexa@lexa.ru>
1+
2018-01-19 Alex Tutubalin <lexa@lexa.ru>
2+
Secunia #79000:
3+
Credit: Laurent Delosieres, Secunia Research at Flexera
4+
* All legacy (RGB raw) image loaders checks for imgdata.image is not NULL
5+
* kodak_radc_load_raw: check image size before processing
6+
* legacy memory allocator: allocate max(widh,raw_width)*max(height,raw_height)
7+
8+
2017-12-06 Alex Tutubalin <lexa@lexa.ru>
29
Secunia #76000:
310
* Fixed fuji_width handling if file is neither fuji nor DNG
411
* Fixed xtrans interpolate for broken xtrans pattern

Diff for: dcraw/dcraw.c

+52-2
Original file line numberDiff line numberDiff line change
@@ -1886,6 +1886,10 @@ void CLASS nikon_load_raw()
18861886

18871887
void CLASS nikon_yuv_load_raw()
18881888
{
1889+
#ifdef LIBRAW_LIBRARY_BUILD
1890+
if(!image)
1891+
throw LIBRAW_EXCEPTION_IO_CORRUPT;
1892+
#endif
18891893
int row, col, yuv[4], rgb[3], b, c;
18901894
UINT64 bitbuf = 0;
18911895
float cmul[4];
@@ -2815,6 +2819,10 @@ void CLASS sinar_4shot_load_raw()
28152819
unpacked_load_raw();
28162820
return;
28172821
}
2822+
#ifdef LIBRAW_LIBRARY_BUILD
2823+
else if(!image)
2824+
throw LIBRAW_EXCEPTION_IO_CORRUPT;
2825+
#endif
28182826
pixel = (ushort *)calloc(raw_width, sizeof *pixel);
28192827
merror(pixel, "sinar_4shot_load_raw()");
28202828
#ifdef LIBRAW_LIBRARY_BUILD
@@ -2857,8 +2865,10 @@ void CLASS imacon_full_load_raw()
28572865
{
28582866
int row, col;
28592867

2860-
if (!image)
2861-
return;
2868+
#ifdef LIBRAW_LIBRARY_BUILD
2869+
if(!image)
2870+
throw LIBRAW_EXCEPTION_IO_CORRUPT;
2871+
#endif
28622872

28632873
#ifdef LIBRAW_LIBRARY_BUILD
28642874
unsigned short *buf = (unsigned short *)malloc(width * 3 * sizeof(unsigned short));
@@ -3404,6 +3414,12 @@ void CLASS quicktake_100_load_raw()
34043414

34053415
void CLASS kodak_radc_load_raw()
34063416
{
3417+
#ifdef LIBRAW_LIBRARY_BUILD
3418+
// All kodak radc images are 768x512
3419+
if(width>768 || raw_width>768 || height > 512 || raw_height>512 )
3420+
throw LIBRAW_EXCEPTION_IO_CORRUPT;
3421+
#endif
3422+
34073423
static const signed char src[] = {
34083424
1, 1, 2, 3, 3, 4, 4, 2, 5, 7, 6, 5, 7, 6, 7, 8, 1, 0, 2, 1, 3, 3, 4, 4, 5, 2, 6, 7, 7, 6,
34093425
8, 5, 8, 8, 2, 1, 2, 3, 3, 0, 3, 2, 3, 4, 4, 6, 5, 5, 6, 7, 6, 8, 2, 0, 2, 1, 2, 3, 3, 2,
@@ -3652,6 +3668,10 @@ void CLASS gamma_curve(double pwr, double ts, int mode, int imax);
36523668

36533669
void CLASS lossy_dng_load_raw()
36543670
{
3671+
#ifdef LIBRAW_LIBRARY_BUILD
3672+
if(!image)
3673+
throw LIBRAW_EXCEPTION_IO_CORRUPT;
3674+
#endif
36553675
struct jpeg_decompress_struct cinfo;
36563676
struct jpeg_error_mgr jerr;
36573677
JSAMPARRAY buf;
@@ -3806,6 +3826,11 @@ void CLASS eight_bit_load_raw()
38063826

38073827
void CLASS kodak_c330_load_raw()
38083828
{
3829+
#ifdef LIBRAW_LIBRARY_BUILD
3830+
if(!image)
3831+
throw LIBRAW_EXCEPTION_IO_CORRUPT;
3832+
#endif
3833+
38093834
uchar *pixel;
38103835
int row, col, y, cb, cr, rgb[3], c;
38113836

@@ -3849,6 +3874,11 @@ void CLASS kodak_c330_load_raw()
38493874

38503875
void CLASS kodak_c603_load_raw()
38513876
{
3877+
#ifdef LIBRAW_LIBRARY_BUILD
3878+
if(!image)
3879+
throw LIBRAW_EXCEPTION_IO_CORRUPT;
3880+
#endif
3881+
38523882
uchar *pixel;
38533883
int row, col, y, cb, cr, rgb[3], c;
38543884

@@ -4028,6 +4058,10 @@ void CLASS kodak_65000_load_raw()
40284058

40294059
void CLASS kodak_ycbcr_load_raw()
40304060
{
4061+
#ifdef LIBRAW_LIBRARY_BUILD
4062+
if(!image)
4063+
throw LIBRAW_EXCEPTION_IO_CORRUPT;
4064+
#endif
40314065
short buf[384], *bp;
40324066
int row, col, len, c, i, j, k, y[2][2], cb, cr, rgb[3];
40334067
ushort *ip;
@@ -4067,6 +4101,10 @@ void CLASS kodak_ycbcr_load_raw()
40674101

40684102
void CLASS kodak_rgb_load_raw()
40694103
{
4104+
#ifdef LIBRAW_LIBRARY_BUILD
4105+
if(!image)
4106+
throw LIBRAW_EXCEPTION_IO_CORRUPT;
4107+
#endif
40704108
short buf[768], *bp;
40714109
int row, col, len, c, i, rgb[3], ret;
40724110
ushort *ip = image[0];
@@ -4096,6 +4134,10 @@ void CLASS kodak_rgb_load_raw()
40964134

40974135
void CLASS kodak_thumb_load_raw()
40984136
{
4137+
#ifdef LIBRAW_LIBRARY_BUILD
4138+
if(!image)
4139+
throw LIBRAW_EXCEPTION_IO_CORRUPT;
4140+
#endif
40994141
int row, col;
41004142
colors = thumb_misc >> 5;
41014143
for (row = 0; row < height; row++)
@@ -4809,6 +4851,10 @@ void CLASS foveon_thumb()
48094851

48104852
void CLASS foveon_sd_load_raw()
48114853
{
4854+
#ifdef LIBRAW_LIBRARY_BUILD
4855+
if(!image)
4856+
throw LIBRAW_EXCEPTION_IO_CORRUPT;
4857+
#endif
48124858
struct decode *dindex;
48134859
short diff[1024];
48144860
unsigned bitbuf = 0;
@@ -4869,6 +4915,10 @@ void CLASS foveon_huff(ushort *huff)
48694915

48704916
void CLASS foveon_dp_load_raw()
48714917
{
4918+
#ifdef LIBRAW_LIBRARY_BUILD
4919+
if(!image)
4920+
throw LIBRAW_EXCEPTION_IO_CORRUPT;
4921+
#endif
48724922
unsigned c, roff[4], row, col, diff;
48734923
ushort huff[512], vpred[2][2], hpred[2];
48744924

Diff for: internal/dcraw_common.cpp

+44-2
Original file line numberDiff line numberDiff line change
@@ -1595,6 +1595,10 @@ void CLASS nikon_load_raw()
15951595

15961596
void CLASS nikon_yuv_load_raw()
15971597
{
1598+
#ifdef LIBRAW_LIBRARY_BUILD
1599+
if(!image)
1600+
throw LIBRAW_EXCEPTION_IO_CORRUPT;
1601+
#endif
15981602
int row, col, yuv[4], rgb[3], b, c;
15991603
UINT64 bitbuf = 0;
16001604
float cmul[4];
@@ -2519,6 +2523,10 @@ void CLASS sinar_4shot_load_raw()
25192523
unpacked_load_raw();
25202524
return;
25212525
}
2526+
#ifdef LIBRAW_LIBRARY_BUILD
2527+
else if(!image)
2528+
throw LIBRAW_EXCEPTION_IO_CORRUPT;
2529+
#endif
25222530
pixel = (ushort *)calloc(raw_width, sizeof *pixel);
25232531
merror(pixel, "sinar_4shot_load_raw()");
25242532
#ifdef LIBRAW_LIBRARY_BUILD
@@ -2561,8 +2569,10 @@ void CLASS imacon_full_load_raw()
25612569
{
25622570
int row, col;
25632571

2564-
if (!image)
2565-
return;
2572+
#ifdef LIBRAW_LIBRARY_BUILD
2573+
if(!image)
2574+
throw LIBRAW_EXCEPTION_IO_CORRUPT;
2575+
#endif
25662576

25672577
#ifdef LIBRAW_LIBRARY_BUILD
25682578
unsigned short *buf = (unsigned short *)malloc(width * 3 * sizeof(unsigned short));
@@ -3108,6 +3118,12 @@ void CLASS quicktake_100_load_raw()
31083118

31093119
void CLASS kodak_radc_load_raw()
31103120
{
3121+
#ifdef LIBRAW_LIBRARY_BUILD
3122+
// All kodak radc images are 768x512
3123+
if(width>768 || raw_width>768 || height > 512 || raw_height>512 )
3124+
throw LIBRAW_EXCEPTION_IO_CORRUPT;
3125+
#endif
3126+
31113127
static const signed char src[] = {
31123128
1, 1, 2, 3, 3, 4, 4, 2, 5, 7, 6, 5, 7, 6, 7, 8, 1, 0, 2, 1, 3, 3, 4, 4, 5, 2, 6, 7, 7, 6,
31133129
8, 5, 8, 8, 2, 1, 2, 3, 3, 0, 3, 2, 3, 4, 4, 6, 5, 5, 6, 7, 6, 8, 2, 0, 2, 1, 2, 3, 3, 2,
@@ -3356,6 +3372,10 @@ void CLASS gamma_curve(double pwr, double ts, int mode, int imax);
33563372

33573373
void CLASS lossy_dng_load_raw()
33583374
{
3375+
#ifdef LIBRAW_LIBRARY_BUILD
3376+
if(!image)
3377+
throw LIBRAW_EXCEPTION_IO_CORRUPT;
3378+
#endif
33593379
struct jpeg_decompress_struct cinfo;
33603380
struct jpeg_error_mgr jerr;
33613381
JSAMPARRAY buf;
@@ -3510,6 +3530,11 @@ void CLASS eight_bit_load_raw()
35103530

35113531
void CLASS kodak_c330_load_raw()
35123532
{
3533+
#ifdef LIBRAW_LIBRARY_BUILD
3534+
if(!image)
3535+
throw LIBRAW_EXCEPTION_IO_CORRUPT;
3536+
#endif
3537+
35133538
uchar *pixel;
35143539
int row, col, y, cb, cr, rgb[3], c;
35153540

@@ -3553,6 +3578,11 @@ void CLASS kodak_c330_load_raw()
35533578

35543579
void CLASS kodak_c603_load_raw()
35553580
{
3581+
#ifdef LIBRAW_LIBRARY_BUILD
3582+
if(!image)
3583+
throw LIBRAW_EXCEPTION_IO_CORRUPT;
3584+
#endif
3585+
35563586
uchar *pixel;
35573587
int row, col, y, cb, cr, rgb[3], c;
35583588

@@ -3732,6 +3762,10 @@ void CLASS kodak_65000_load_raw()
37323762

37333763
void CLASS kodak_ycbcr_load_raw()
37343764
{
3765+
#ifdef LIBRAW_LIBRARY_BUILD
3766+
if(!image)
3767+
throw LIBRAW_EXCEPTION_IO_CORRUPT;
3768+
#endif
37353769
short buf[384], *bp;
37363770
int row, col, len, c, i, j, k, y[2][2], cb, cr, rgb[3];
37373771
ushort *ip;
@@ -3771,6 +3805,10 @@ void CLASS kodak_ycbcr_load_raw()
37713805

37723806
void CLASS kodak_rgb_load_raw()
37733807
{
3808+
#ifdef LIBRAW_LIBRARY_BUILD
3809+
if(!image)
3810+
throw LIBRAW_EXCEPTION_IO_CORRUPT;
3811+
#endif
37743812
short buf[768], *bp;
37753813
int row, col, len, c, i, rgb[3], ret;
37763814
ushort *ip = image[0];
@@ -3800,6 +3838,10 @@ void CLASS kodak_rgb_load_raw()
38003838

38013839
void CLASS kodak_thumb_load_raw()
38023840
{
3841+
#ifdef LIBRAW_LIBRARY_BUILD
3842+
if(!image)
3843+
throw LIBRAW_EXCEPTION_IO_CORRUPT;
3844+
#endif
38033845
int row, col;
38043846
colors = thumb_misc >> 5;
38053847
for (row = 0; row < height; row++)

Diff for: src/libraw_cxx.cpp

+1-1
Original file line numberDiff line numberDiff line change
@@ -2792,7 +2792,7 @@ int LibRaw::unpack(void)
27922792
// sRAW and old Foveon decoders only, so extra buffer size is just 1/4
27932793
// allocate image as temporary buffer, size
27942794
imgdata.rawdata.raw_alloc = 0;
2795-
imgdata.image = (ushort(*)[4])calloc(unsigned(S.raw_width) * unsigned(S.raw_height), sizeof(*imgdata.image));
2795+
imgdata.image = (ushort(*)[4])calloc(unsigned(MAX(S.width,S.raw_width)) * unsigned(MAX(S.height,S.raw_height)), sizeof(*imgdata.image));
27962796
if (!(decoder_info.decoder_flags & LIBRAW_DECODER_ADOBECOPYPIXEL))
27972797
{
27982798
imgdata.rawdata.raw_image = (ushort *)imgdata.image;

0 commit comments

Comments
 (0)