Backport fixes for CVE-2026-20889 and CVE-2026-21413 from upstream
These are backported from the upstream commits [1,2] to fit the
0.19-stable branch.
[1] Commit b9809e410d07ca7b
https://github.com/LibRaw/LibRaw/commit/b9809e410d07ca7b
[2] Commit 75ed2c12a35b765b
https://github.com/LibRaw/LibRaw/commit/75ed2c12a35b765b
Resolves: RHEL-165404, RHEL-165408
This commit is contained in:
Debarshi Ray
parent
8d182902cc
commit
c191d916a5
92
LibRaw-CVE-2026-20889-TALOS-2026-2358.patch
Normal file
92
LibRaw-CVE-2026-20889-TALOS-2026-2358.patch
Normal file
@ -0,0 +1,92 @@
|
||||
From 7e315d12429c91aa7d7e6402db00ac0cdd173ad5 Mon Sep 17 00:00:00 2001
|
||||
From: Debarshi Ray <debarshir@gnome.org>
|
||||
Date: Wed, 29 Apr 2026 23:42:31 +0200
|
||||
Subject: [PATCH] Fix for TALOS-2026-2358
|
||||
|
||||
(backported from commit b9809e410d07ca7bf408e6d036615fb34f8c47cc)
|
||||
---
|
||||
internal/libraw_x3f.cpp | 7 +++++++
|
||||
src/libraw_cxx.cpp | 20 +++++++++++++++++++-
|
||||
2 files changed, 26 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/internal/libraw_x3f.cpp b/internal/libraw_x3f.cpp
|
||||
index 49918e99d2ce..2976eaf70929 100644
|
||||
--- a/internal/libraw_x3f.cpp
|
||||
+++ b/internal/libraw_x3f.cpp
|
||||
@@ -1579,7 +1579,14 @@ static uint32_t read_data_block(void **data,
|
||||
if (fpos + size > I->input.file->size())
|
||||
throw LIBRAW_EXCEPTION_IO_CORRUPT;
|
||||
|
||||
+ // All known files from real cameras are many times smaller than 1 GB, so the hard limit is OK here.
|
||||
+
|
||||
+ if(size > 1024*1024*1024)
|
||||
+ throw LIBRAW_EXCEPTION_ALLOC;
|
||||
+
|
||||
*data = (void *)malloc(size);
|
||||
+ if (!*data)
|
||||
+ throw LIBRAW_EXCEPTION_ALLOC;
|
||||
|
||||
GETN(*data, size);
|
||||
|
||||
diff --git a/src/libraw_cxx.cpp b/src/libraw_cxx.cpp
|
||||
index 51d0ebbc9fc8..a5cdf8ae6b01 100644
|
||||
--- a/src/libraw_cxx.cpp
|
||||
+++ b/src/libraw_cxx.cpp
|
||||
@@ -4432,6 +4432,8 @@ int LibRaw::unpack_thumb(void)
|
||||
{
|
||||
x3f_thumb_loader();
|
||||
SET_PROC_FLAG(LIBRAW_PROGRESS_THUMB_LOAD);
|
||||
+ if (!T.twidth && !T.theight)
|
||||
+ return LIBRAW_NO_THUMBNAIL;
|
||||
return 0;
|
||||
}
|
||||
else
|
||||
@@ -6380,6 +6382,7 @@ void LibRaw::x3f_thumb_loader()
|
||||
{
|
||||
try
|
||||
{
|
||||
+ INT64 checked_size = x3f_thumb_size(); // This value was checked at upper level?
|
||||
x3f_t *x3f = (x3f_t *)_x3f_data;
|
||||
if (!x3f)
|
||||
return; // No data pointer set
|
||||
@@ -6397,6 +6400,12 @@ void LibRaw::x3f_thumb_loader()
|
||||
imgdata.thumbnail.tcolors = 3;
|
||||
if (imgdata.thumbnail.tformat == LIBRAW_THUMBNAIL_JPEG)
|
||||
{
|
||||
+ INT64 alloc_size = ID->data_size;
|
||||
+ if ((alloc_size > 2 * checked_size) || (alloc_size > 1024LL * 1024LL * LIBRAW_MAX_THUMBNAIL_MB))
|
||||
+ throw LIBRAW_EXCEPTION_TOOBIG;
|
||||
+ if(alloc_size < 64LL)
|
||||
+ throw LIBRAW_EXCEPTION_IO_CORRUPT;
|
||||
+
|
||||
imgdata.thumbnail.thumb = (char *)malloc(ID->data_size);
|
||||
merror(imgdata.thumbnail.thumb, "LibRaw::x3f_thumb_loader()");
|
||||
memmove(imgdata.thumbnail.thumb, ID->data, ID->data_size);
|
||||
@@ -6404,6 +6413,12 @@ void LibRaw::x3f_thumb_loader()
|
||||
}
|
||||
else if (imgdata.thumbnail.tformat == LIBRAW_THUMBNAIL_BITMAP)
|
||||
{
|
||||
+ INT64 alloc_size = INT64(ID->columns) * INT64(ID->rows) * 3LL;
|
||||
+ if ((alloc_size > 2 * checked_size) ||
|
||||
+ (alloc_size > 1024LL * 1024LL * LIBRAW_MAX_THUMBNAIL_MB)) throw LIBRAW_EXCEPTION_TOOBIG;
|
||||
+ if (alloc_size < 64LL)
|
||||
+ throw LIBRAW_EXCEPTION_IO_CORRUPT;
|
||||
+
|
||||
imgdata.thumbnail.tlength = ID->columns * ID->rows * 3;
|
||||
imgdata.thumbnail.thumb = (char *)malloc(ID->columns * ID->rows * 3);
|
||||
merror(imgdata.thumbnail.thumb, "LibRaw::x3f_thumb_loader()");
|
||||
@@ -6421,7 +6436,10 @@ void LibRaw::x3f_thumb_loader()
|
||||
}
|
||||
catch (...)
|
||||
{
|
||||
- // do nothing
|
||||
+ // no rethrow: handled at upper level
|
||||
+ imgdata.thumbnail.twidth = 0;
|
||||
+ imgdata.thumbnail.theight = 0;
|
||||
+ imgdata.thumbnail.tcolors = 0;
|
||||
}
|
||||
}
|
||||
|
||||
--
|
||||
2.53.0
|
||||
|
||||
24
LibRaw-CVE-2026-21413-TALOS-2026-2331.patch
Normal file
24
LibRaw-CVE-2026-21413-TALOS-2026-2331.patch
Normal file
@ -0,0 +1,24 @@
|
||||
diff -urNp LibRaw-0.19.5.orig/dcraw/dcraw.c LibRaw-0.19.5/dcraw/dcraw.c
|
||||
--- LibRaw-0.19.5.orig/dcraw/dcraw.c 2026-04-28 23:52:51.314912726 +0200
|
||||
+++ LibRaw-0.19.5/dcraw/dcraw.c 2026-04-29 00:05:10.714922134 +0200
|
||||
@@ -953,7 +953,7 @@ void CLASS lossless_jpeg_load_raw()
|
||||
}
|
||||
if (raw_width == 3984 && (col -= 2) < 0)
|
||||
col += (row--,raw_width);
|
||||
- if ((unsigned) row < raw_height) RAW(row,col) = val;
|
||||
+ if (((unsigned) row < raw_height) && ((unsigned) col < raw_width)) RAW(row,col) = val;
|
||||
if (++col >= raw_width)
|
||||
col = (row++,0);
|
||||
}
|
||||
diff -urNp LibRaw-0.19.5.orig/internal/dcraw_common.cpp LibRaw-0.19.5/internal/dcraw_common.cpp
|
||||
--- LibRaw-0.19.5.orig/internal/dcraw_common.cpp 2026-04-28 23:52:51.315669819 +0200
|
||||
+++ LibRaw-0.19.5/internal/dcraw_common.cpp 2026-04-29 00:03:21.023739250 +0200
|
||||
@@ -1067,7 +1067,7 @@ void CLASS lossless_jpeg_load_raw()
|
||||
#else
|
||||
longjmp(failure, 3);
|
||||
#endif
|
||||
- if ((unsigned)row < raw_height)
|
||||
+ if (((unsigned)row < raw_height) && ((unsigned)col < raw_width))
|
||||
RAW(row, col) = val;
|
||||
if (++col >= raw_width)
|
||||
col = (row++, 0);
|
||||
14
LibRaw.spec
14
LibRaw.spec
@ -1,8 +1,8 @@
|
||||
Summary: Library for reading RAW files obtained from digital photo cameras
|
||||
Name: LibRaw
|
||||
Version: 0.19.5
|
||||
Release: 4%{?dist}
|
||||
License: BSD and (CDDL or LGPLv2)
|
||||
Release: 5%{?dist}
|
||||
License: BSD-3-Clause and (CDDL-1.0 or LGPL-2.1-only)
|
||||
URL: http://www.libraw.org
|
||||
|
||||
BuildRequires: gcc-c++
|
||||
@ -16,6 +16,9 @@ Patch0: LibRaw-0.6.0-pkgconfig.patch
|
||||
Patch1: LibRaw-CVE-2020-15503.patch
|
||||
Patch2: LibRaw-CVE-2020-24870.patch
|
||||
Patch3: LibRaw-CVE-2021-32142.patch
|
||||
Patch4: LibRaw-CVE-2026-20889-TALOS-2026-2358.patch
|
||||
Patch5: LibRaw-CVE-2026-21413-TALOS-2026-2331.patch
|
||||
|
||||
Provides: bundled(dcraw) = 9.25
|
||||
|
||||
%description
|
||||
@ -58,6 +61,8 @@ LibRaw sample programs
|
||||
%patch1 -p1 -b .cve-2020-15503
|
||||
%patch2 -p1 -b .cve-2020-24870
|
||||
%patch3 -p1 -b .cve-2021-32142
|
||||
%patch4 -p1 -b .cve-2026-20889
|
||||
%patch5 -p1 -b .cve-2026-21413
|
||||
|
||||
%build
|
||||
autoreconf -if
|
||||
@ -121,6 +126,11 @@ rm -fv %{buildroot}%{_libdir}/lib*.la
|
||||
|
||||
|
||||
%changelog
|
||||
* Tue Apr 28 2026 Debarshi Ray <rishi@fedoraproject.org> - 0.19.5-5
|
||||
- Backport fixes for CVE-2026-20889 and CVE-2026-21413 from upstream
|
||||
- Migrate to SPDX license
|
||||
Resolves: RHEL-165404, RHEL-165408
|
||||
|
||||
* Mon Oct 23 2023 Debarshi Ray <rishi@fedoraproject.org> - 0.19.5-4
|
||||
- Backport fix for CVE-2021-32142 from upstream
|
||||
Resolves: RHEL-9523
|
||||
|
||||
Loading…
Reference in New Issue
Block a user