Skip to content

Commit 2f912f5

Browse files
committed
fixed wrong data_maximum calcluation; prevent out-of-buffer in exp_bef
1 parent f306538 commit 2f912f5

File tree

1 file changed

+12
-8
lines changed

1 file changed

+12
-8
lines changed

Diff for: src/libraw_cxx.cpp

+12-8
Original file line numberDiff line numberDiff line change
@@ -2336,14 +2336,15 @@ int LibRaw::subtract_black()
23362336
#define MAX(a,b) ((a) > (b) ? (a) : (b))
23372337
#define LIM(x,min,max) MAX(min,MIN(x,max))
23382338
#define CLIP(x) LIM(x,0,65535)
2339-
2340-
for(i=0; i< size*4; i++)
2339+
int dmax = 0;
2340+
for(i=0; i< size*4; i++)
23412341
{
23422342
int val = imgdata.image[0][i];
23432343
val -= cblk[i & 3];
23442344
imgdata.image[0][i] = CLIP(val);
2345-
if(C.data_maximum < val) C.data_maximum = val;
2345+
if(dmax < val) dmax = val;
23462346
}
2347+
C.data_maximum = dmax & 0xffff;
23472348
#undef MIN
23482349
#undef MAX
23492350
#undef LIM
@@ -2359,9 +2360,10 @@ int LibRaw::subtract_black()
23592360
// only calculate channel maximum;
23602361
int idx;
23612362
ushort *p = (ushort*)imgdata.image;
2362-
C.data_maximum = 0;
2363+
int dmax = 0;
23632364
for(idx=0;idx<S.iheight*S.iwidth*4;idx++)
2364-
if(C.data_maximum < p[idx]) C.data_maximum = p[idx];
2365+
if(dmax < p[idx]) dmax = p[idx];
2366+
C.data_maximum = dmax;
23652367
}
23662368
return 0;
23672369
}
@@ -2421,8 +2423,10 @@ void LibRaw::exp_bef(float shift, float smooth)
24212423
imgdata.image[i][3] = lut[imgdata.image[i][3]];
24222424
}
24232425

2424-
C.data_maximum = lut[C.data_maximum];
2425-
C.maximum = lut[C.maximum];
2426+
if(C.data_maximum <=TBLN)
2427+
C.data_maximum = lut[C.data_maximum];
2428+
if(C.maximum <= TBLN)
2429+
C.maximum = lut[C.maximum];
24262430
// no need to adjust the minumum, black is already subtracted
24272431
free(lut);
24282432
}
@@ -2530,7 +2534,7 @@ int LibRaw::dcraw_process(void)
25302534

25312535
raw2image_ex(subtract_inline); // allocate imgdata.image and copy data!
25322536

2533-
int save_4color = O.four_color_rgb;
2537+
int save_4color = O.four_color_rgb;
25342538

25352539
if (IO.zero_is_bad)
25362540
{

0 commit comments

Comments
 (0)