rpms/LibRaw
7
0
Fork 0
Code Issues Pull Requests Releases Activity

0.18.5

Browse Source
This commit is contained in:
Gwyn Ciesla 2017-09-22 08:33:07 -05:00
parent 3fbdcce34b
commit 6dcf4d5676
4 changed files with 11 additions and 77 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
.gitignore vendored
View File

@ -54,3 +54,6 @@ LibRaw-0.9.1.tar.gz
/LibRaw-0.18.4.tar.gz
/LibRaw-demosaic-pack-GPL2-0.18.4.tar.gz
/LibRaw-demosaic-pack-GPL3-0.18.4.tar.gz
/LibRaw-0.18.5.tar.gz
/LibRaw-demosaic-pack-GPL2-0.18.5.tar.gz
/LibRaw-demosaic-pack-GPL3-0.18.5.tar.gz

9
LibRaw.spec
View File

@ -1,7 +1,7 @@
Summary: Library for reading RAW files obtained from digital photo cameras
Name: LibRaw
Version: 0.18.4
Release: 2%{?dist}
Version: 0.18.5
Release: 1%{?dist}
License: GPLv3+
Group: Development/Libraries
URL: http://www.libraw.org
@ -14,7 +14,6 @@ Source1: http://www.libraw.org/data/%{name}-demosaic-pack-GPL2-%{version}.tar.gz
Source2: http://www.libraw.org/data/%{name}-demosaic-pack-GPL3-%{version}.tar.gz
Patch0: LibRaw-0.6.0-pkgconfig.patch
Patch1: LibRaw-0.17.1-CVE-2015-8366-8367.patch
Patch2: d13e8f6d1e987b7491182040a188c16a395f1d21.patch
Provides: bundled(dcraw) = 9.25
@ -56,7 +55,6 @@ LibRaw sample programs
%patch0 -p0 -b .pkgconfig
%patch1 -p1 -b .CVE-2015-8366
%patch2 -p1 -b .CVE-2017-14348
%build
%configure --enable-examples=yes --enable-jasper --enable-lcms \
@ -105,6 +103,9 @@ make install DESTDIR=%{buildroot}
%postun -p /sbin/ldconfig
%changelog
* Fri Sep 22 2017 Gwyn Ciesla <limburgher@gmail.com> - 0.18.5-1
- 0.18.5
* Fri Sep 15 2017 Gwyn Ciesla <limburgher@gmail.com> - 0.18.4-2
- Patch for CVE-2017-14348.

70
d13e8f6d1e987b7491182040a188c16a395f1d21.patch
View File

@ -1,70 +0,0 @@
From d13e8f6d1e987b7491182040a188c16a395f1d21 Mon Sep 17 00:00:00 2001
From: Alex Tutubalin <lexa@lexa.ru>
Date: Wed, 13 Sep 2017 09:31:01 +0300
Subject: [PATCH] CVE-2017-1438 credits; fix for Kodak 65000 out of bounds
access
---
Changelog.txt | 6 +++++-
dcraw/dcraw.c | 11 +++++++++--
internal/dcraw_common.cpp | 11 +++++++++--
3 files changed, 23 insertions(+), 5 deletions(-)
diff --git a/Changelog.txt b/Changelog.txt
index 95bdc952..9b247882 100755
--- a/Changelog.txt
+++ b/Changelog.txt
@@ -1,5 +1,9 @@
+2017-09-13 Alex Tutubalin <lexa@lexa.ru>
+ * Fixed possible out of bound access in Kodak 6500 loader
+
2017-09-12 Alex Tutubalin <lexa@lexa.ru>
- * Fix for possible heap overrun in Canon makernotes parser
+ * CVE-2017-14348: Fix for possible heap overrun in Canon makernotes parser
+ Credit: Henri Salo from Nixu Corporation
* LibRaw 0.18.4
2017-09-09 Alex Tutubalin <lexa@lexa.ru>
diff --git a/internal/dcraw_common.cpp b/internal/dcraw_common.cpp
index 18bcdbcb..8fb2b073 100644
--- a/internal/dcraw_common.cpp
+++ b/internal/dcraw_common.cpp
@@ -3240,8 +3240,15 @@ void CLASS kodak_65000_load_raw()
len = MIN (256, width-col);
ret = kodak_65000_decode (buf, len);
for (i=0; i < len; i++)
- if ((RAW(row,col+i) = curve[ret ? buf[i] :
- (pred[i & 1] += buf[i])]) >> 12) derror();
+ {
+ int idx = ret ? buf[i] : (pred[i & 1] += buf[i]);
+ if(idx >=0 && idx <= 0xffff)
+ {
+ if ((RAW(row,col+i) = curve[idx]) >> 12) derror();
+ }
+ else
+ derror();
+ }
}
}
}
--- LibRaw-0.18.4/dcraw/dcraw.c~ 2017-09-15 09:17:55.000000000 -0500
+++ LibRaw-0.18.4/dcraw/dcraw.c 2017-09-15 09:20:29.532287605 -0500
@@ -2589,8 +2589,16 @@
len = MIN (256, width-col);
ret = kodak_65000_decode (buf, len);
for (i=0; i < len; i++)
- if ((RAW(row,col+i) = curve[ret ? buf[i] :
- (pred[i & 1] += buf[i])]) >> 12) derror();
+ {
+ int idx = ret ? buf[i] : (pred[i & 1] += buf[i]);
+ if(idx >=0 && idx <= 0xffff)
+ {
+ if ((RAW(row,col+i) = curve[idx]) >> 12) derror();
+ }
+ else
+ derror();
+ }
+
}
}

6
sources
View File

@ -1,3 +1,3 @@
SHA512 (LibRaw-0.18.4.tar.gz) = e71db23a70f0cda745ae862f4cb6a0c51c968e4c7399f28e86de8beb894526fa76cd337c1406e2eaee3f287f15e8912d1a0f7217493c6444a491ca3329f63776
SHA512 (LibRaw-demosaic-pack-GPL2-0.18.4.tar.gz) = 05bef76530f9237e1d1bfe08014f30de328b68319f88d126aaffa8baf3b89615d160bac36a6ad2cc38cab0faeb8c4bf86714dd568e7f01cfd1ee2513ac175a5d
SHA512 (LibRaw-demosaic-pack-GPL3-0.18.4.tar.gz) = 158d951d0e1c35f1ebdde8849f0b51e23332c8b5b13a4b0ab0677a3d4a1682afd6e7c5dec4194072b4588699bf49a023591fa1b05d2a8f4c54cd1a44e65e3ad9
SHA512 (LibRaw-0.18.5.tar.gz) = 751a1c54507b7408d0d36c3f1fb0e31928f5ae540fae42eb2b57d8fcebcd44134dc452a4f3838dd31dbc8fb3978a6cac6129429a3350f8be5dc44146309aff81
SHA512 (LibRaw-demosaic-pack-GPL2-0.18.5.tar.gz) = 1599695394717558e61844e32d76bf653741592d81691c9f55bfb72c8c5d485bce4eab3fc0eefd37640254c431bd78706fe04ca547e42566dda789f0b6559af5
SHA512 (LibRaw-demosaic-pack-GPL3-0.18.5.tar.gz) = c00193b64673e093c33a9d1316448eea4eb7e2b274d5d3bd39cef02b7269e56ce72f9b47831039e00b2feb8344b5266f9c03b5f11212d520809674db253cb028