From a403054e97472efc218ef93bcf4dfa1cc6f1cec1 Mon Sep 17 00:00:00 2001 From: AlmaLinux RelEng Bot Date: Fri, 7 Aug 2026 03:10:44 -0400 Subject: [PATCH] import Oracle_OSS LibRaw-0.21.1-2.el9_8.1 --- SOURCES/LibRaw-CVE-2026-51235.patch | 74 +++++++++++++++++++++++++++++ SPECS/LibRaw.spec | 18 +++++-- 2 files changed, 87 insertions(+), 5 deletions(-) create mode 100644 SOURCES/LibRaw-CVE-2026-51235.patch diff --git a/SOURCES/LibRaw-CVE-2026-51235.patch b/SOURCES/LibRaw-CVE-2026-51235.patch new file mode 100644 index 0000000..3600c38 --- /dev/null +++ b/SOURCES/LibRaw-CVE-2026-51235.patch @@ -0,0 +1,74 @@ +From b730c0087ec110516736c29ef2c9b67498bf6a8d Mon Sep 17 00:00:00 2001 +From: Alex Tutubalin +Date: Wed, 13 May 2026 12:13:22 +0300 +Subject: [PATCH] rotated fuji: stricter image size limits; raw2image(ex): + avoid possible 32-bit overflow on alloc size calculations + +--- + src/metadata/identify.cpp | 4 ++++ + src/preprocessing/raw2image.cpp | 10 +++++----- + src/utils/phaseone_processing.cpp | 2 +- + 3 files changed, 10 insertions(+), 6 deletions(-) + +diff --git a/src/metadata/identify.cpp b/src/metadata/identify.cpp +index aabbf85..8dd3b22 100644 +--- a/src/metadata/identify.cpp ++++ b/src/metadata/identify.cpp +@@ -1215,6 +1215,10 @@ dng_skip: + // Prevent incorrect-sized fuji-rotated files + if (INT64(width)*INT64(height) > INT64(raw_width) * INT64(raw_height) * 8LL) + is_raw = 0; ++ ++ // All 'fuji-rotated' images are 6Mpix or less, so 8k x 8k limit is OK ++ if(width > 8192 || height > 8192 || raw_width > 8192 || raw_height > 8192) ++ is_raw = 0; + } + else + { +diff --git a/src/preprocessing/raw2image.cpp b/src/preprocessing/raw2image.cpp +index 702cf29..b91214f 100644 +--- a/src/preprocessing/raw2image.cpp ++++ b/src/preprocessing/raw2image.cpp +@@ -76,16 +76,16 @@ int LibRaw::raw2image(void) + } + + // free and re-allocate image bitmap ++ INT64 allocate_sz = INT64(S.iheight) * INT64(S.iwidth); + if (imgdata.image) + { + imgdata.image = (ushort(*)[4])realloc( +- imgdata.image, S.iheight * S.iwidth * sizeof(*imgdata.image)); +- memset(imgdata.image, 0, S.iheight * S.iwidth * sizeof(*imgdata.image)); ++ imgdata.image, allocate_sz * sizeof(*imgdata.image)); ++ memset(imgdata.image, 0, allocate_sz * sizeof(*imgdata.image)); + } + else + imgdata.image = +- (ushort(*)[4])calloc(S.iheight * S.iwidth, sizeof(*imgdata.image)); +- ++ (ushort(*)[4])calloc(allocate_sz, sizeof(*imgdata.image)); + + libraw_decoder_info_t decoder_info; + get_decoder_info(&decoder_info); +@@ -392,7 +392,7 @@ int LibRaw::raw2image_ex(int do_subtract_black) + alloc_height = (t_alloc_height + IO.shrink) >> IO.shrink; + alloc_width = (t_alloc_width + IO.shrink) >> IO.shrink; + } +- int alloc_sz = alloc_width * alloc_height; ++ INT64 alloc_sz = INT64(alloc_width) * INT64(alloc_height); + + if (imgdata.image) + { +diff --git a/src/utils/phaseone_processing.cpp b/src/utils/phaseone_processing.cpp +index b82988b..bef831d 100644 +--- a/src/utils/phaseone_processing.cpp ++++ b/src/utils/phaseone_processing.cpp +@@ -21,7 +21,7 @@ + void LibRaw::phase_one_allocate_tempbuffer() + { + // Allocate temp raw_image buffer +- imgdata.rawdata.raw_image = (ushort *)malloc(S.raw_pitch * S.raw_height); ++ imgdata.rawdata.raw_image = (ushort *)malloc(UINT64(S.raw_pitch) * UINT64(S.raw_height)); + } + void LibRaw::phase_one_free_tempbuffer() + { diff --git a/SPECS/LibRaw.spec b/SPECS/LibRaw.spec index 486b63a..e8d517a 100644 --- a/SPECS/LibRaw.spec +++ b/SPECS/LibRaw.spec @@ -7,7 +7,7 @@ Summary: Library for reading RAW files obtained from digital photo cameras Name: LibRaw Version: 0.21.1 -Release: 2%{?dist} +Release: 2%{?dist}.1 License: BSD and LGPLv2 URL: http://www.libraw.org @@ -25,12 +25,16 @@ Patch0: LibRaw-pkgconfig.patch # CVE-2023-1729 Patch1: 9ab70f6dca19229cb5caad7cc31af4e7501bac93.patch -# https://redhat.atlassian.net/browse/RHEL-165456 +# https://redhat.atlassian.net/browse/RHEL-165461 Patch2: LibRaw-CVE-2026-21413-TALOS-2026-2331.patch -# https://redhat.atlassian.net/browse/RHEL-165373 +# https://redhat.atlassian.net/browse/RHEL-165374 Patch3: LibRaw-CVE-2026-24450-TALOS-2026-2363.patch +# https://redhat.atlassian.net/browse/RHEL-219221 +# https://github.com/LibRaw/LibRaw/commit/38359db2ed352e98cef9a90e3f7071c20a2ebdda +Patch4: LibRaw-CVE-2026-51235.patch + Provides: bundled(dcraw) = 9.25 %description @@ -125,9 +129,13 @@ rm -fv %{buildroot}%{_libdir}/lib*.la %changelog -* Mon Apr 27 2026 Debarshi Ray - 0.21.1-2 +* Thu Jul 30 2026 RHEL Packaging Agent - 0.21.1-2.1 +- Fix CVE-2026-51235 +Resolves: RHEL-219221 + +* Tue Apr 28 2026 Debarshi Ray - 0.21.1-2 - Fix CVE-2026-21413 and CVE-2026-24450 -Resolves: RHEL-165373, RHEL-165456 +Resolves: RHEL-165374, RHEL-165461 * Mon Oct 02 2023 Debarshi Ray - 0.21.1-1 - 0.21.1