rpms/LibRaw
7
0
Fork 0
Code Issues Pull Requests Releases Activity

import Oracle_OSS LibRaw-0.21.1-2.el9_8.1

Browse Source
This commit is contained in:
AlmaLinux RelEng Bot 2026-08-07 03:10:44 -04:00
parent 04c8d7cf12
commit a403054e97
2 changed files with 87 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

74
SOURCES/LibRaw-CVE-2026-51235.patch Normal file
View File

@ -0,0 +1,74 @@
From b730c0087ec110516736c29ef2c9b67498bf6a8d Mon Sep 17 00:00:00 2001
From: Alex Tutubalin <lexa@lexa.ru>
Date: Wed, 13 May 2026 12:13:22 +0300
Subject: [PATCH] rotated fuji: stricter image size limits; raw2image(ex):
avoid possible 32-bit overflow on alloc size calculations
---
src/metadata/identify.cpp | 4 ++++
src/preprocessing/raw2image.cpp | 10 +++++-----
src/utils/phaseone_processing.cpp | 2 +-
3 files changed, 10 insertions(+), 6 deletions(-)
diff --git a/src/metadata/identify.cpp b/src/metadata/identify.cpp
index aabbf85..8dd3b22 100644
--- a/src/metadata/identify.cpp
+++ b/src/metadata/identify.cpp
@@ -1215,6 +1215,10 @@ dng_skip:
// Prevent incorrect-sized fuji-rotated files
if (INT64(width)*INT64(height) > INT64(raw_width) * INT64(raw_height) * 8LL)
is_raw = 0;
+
+ // All 'fuji-rotated' images are 6Mpix or less, so 8k x 8k limit is OK
+ if(width > 8192 || height > 8192 || raw_width > 8192 || raw_height > 8192)
+ is_raw = 0;
}
else
{
diff --git a/src/preprocessing/raw2image.cpp b/src/preprocessing/raw2image.cpp
index 702cf29..b91214f 100644
--- a/src/preprocessing/raw2image.cpp
+++ b/src/preprocessing/raw2image.cpp
@@ -76,16 +76,16 @@ int LibRaw::raw2image(void)
}
// free and re-allocate image bitmap
+ INT64 allocate_sz = INT64(S.iheight) * INT64(S.iwidth);
if (imgdata.image)
{
imgdata.image = (ushort(*)[4])realloc(
- imgdata.image, S.iheight * S.iwidth * sizeof(*imgdata.image));
- memset(imgdata.image, 0, S.iheight * S.iwidth * sizeof(*imgdata.image));
+ imgdata.image, allocate_sz * sizeof(*imgdata.image));
+ memset(imgdata.image, 0, allocate_sz * sizeof(*imgdata.image));
}
else
imgdata.image =
- (ushort(*)[4])calloc(S.iheight * S.iwidth, sizeof(*imgdata.image));
-
+ (ushort(*)[4])calloc(allocate_sz, sizeof(*imgdata.image));
libraw_decoder_info_t decoder_info;
get_decoder_info(&decoder_info);
@@ -392,7 +392,7 @@ int LibRaw::raw2image_ex(int do_subtract_black)
alloc_height = (t_alloc_height + IO.shrink) >> IO.shrink;
alloc_width = (t_alloc_width + IO.shrink) >> IO.shrink;
}
- int alloc_sz = alloc_width * alloc_height;
+ INT64 alloc_sz = INT64(alloc_width) * INT64(alloc_height);
if (imgdata.image)
{
diff --git a/src/utils/phaseone_processing.cpp b/src/utils/phaseone_processing.cpp
index b82988b..bef831d 100644
--- a/src/utils/phaseone_processing.cpp
+++ b/src/utils/phaseone_processing.cpp
@@ -21,7 +21,7 @@
void LibRaw::phase_one_allocate_tempbuffer()
{
// Allocate temp raw_image buffer
- imgdata.rawdata.raw_image = (ushort *)malloc(S.raw_pitch * S.raw_height);
+ imgdata.rawdata.raw_image = (ushort *)malloc(UINT64(S.raw_pitch) * UINT64(S.raw_height));
}
void LibRaw::phase_one_free_tempbuffer()
{

18
SPECS/LibRaw.spec
View File

@ -7,7 +7,7 @@
Summary: Library for reading RAW files obtained from digital photo cameras
Name: LibRaw
Version: 0.21.1
Release: 2%{?dist}
Release: 2%{?dist}.1
License: BSD and LGPLv2
URL: http://www.libraw.org
@ -25,12 +25,16 @@ Patch0: LibRaw-pkgconfig.patch
# CVE-2023-1729
Patch1: 9ab70f6dca19229cb5caad7cc31af4e7501bac93.patch
# https://redhat.atlassian.net/browse/RHEL-165456
# https://redhat.atlassian.net/browse/RHEL-165461
Patch2: LibRaw-CVE-2026-21413-TALOS-2026-2331.patch
# https://redhat.atlassian.net/browse/RHEL-165373
# https://redhat.atlassian.net/browse/RHEL-165374
Patch3: LibRaw-CVE-2026-24450-TALOS-2026-2363.patch
# https://redhat.atlassian.net/browse/RHEL-219221
# https://github.com/LibRaw/LibRaw/commit/38359db2ed352e98cef9a90e3f7071c20a2ebdda
Patch4: LibRaw-CVE-2026-51235.patch
Provides: bundled(dcraw) = 9.25
%description
@ -125,9 +129,13 @@ rm -fv %{buildroot}%{_libdir}/lib*.la
%changelog
* Mon Apr 27 2026 Debarshi Ray <rishi@fedoraproject.org> - 0.21.1-2
* Thu Jul 30 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 0.21.1-2.1
- Fix CVE-2026-51235
Resolves: RHEL-219221
* Tue Apr 28 2026 Debarshi Ray <rishi@fedoraproject.org> - 0.21.1-2
- Fix CVE-2026-21413 and CVE-2026-24450
Resolves: RHEL-165373, RHEL-165456
Resolves: RHEL-165374, RHEL-165461
* Mon Oct 02 2023 Debarshi Ray <rishi@fedoraproject.org> - 0.21.1-1
- 0.21.1