diff --git a/LibRaw-CVE-2026-20889-TALOS-2026-2358.patch b/LibRaw-CVE-2026-20889-TALOS-2026-2358.patch new file mode 100644 index 0000000..adf8b7b --- /dev/null +++ b/LibRaw-CVE-2026-20889-TALOS-2026-2358.patch @@ -0,0 +1,92 @@ +From 7e315d12429c91aa7d7e6402db00ac0cdd173ad5 Mon Sep 17 00:00:00 2001 +From: Debarshi Ray +Date: Wed, 29 Apr 2026 23:42:31 +0200 +Subject: [PATCH] Fix for TALOS-2026-2358 + +(backported from commit b9809e410d07ca7bf408e6d036615fb34f8c47cc) +--- + internal/libraw_x3f.cpp | 7 +++++++ + src/libraw_cxx.cpp | 20 +++++++++++++++++++- + 2 files changed, 26 insertions(+), 1 deletion(-) + +diff --git a/internal/libraw_x3f.cpp b/internal/libraw_x3f.cpp +index 49918e99d2ce..2976eaf70929 100644 +--- a/internal/libraw_x3f.cpp ++++ b/internal/libraw_x3f.cpp +@@ -1579,7 +1579,14 @@ static uint32_t read_data_block(void **data, + if (fpos + size > I->input.file->size()) + throw LIBRAW_EXCEPTION_IO_CORRUPT; + ++ // All known files from real cameras are many times smaller than 1 GB, so the hard limit is OK here. ++ ++ if(size > 1024*1024*1024) ++ throw LIBRAW_EXCEPTION_ALLOC; ++ + *data = (void *)malloc(size); ++ if (!*data) ++ throw LIBRAW_EXCEPTION_ALLOC; + + GETN(*data, size); + +diff --git a/src/libraw_cxx.cpp b/src/libraw_cxx.cpp +index 51d0ebbc9fc8..a5cdf8ae6b01 100644 +--- a/src/libraw_cxx.cpp ++++ b/src/libraw_cxx.cpp +@@ -4432,6 +4432,8 @@ int LibRaw::unpack_thumb(void) + { + x3f_thumb_loader(); + SET_PROC_FLAG(LIBRAW_PROGRESS_THUMB_LOAD); ++ if (!T.twidth && !T.theight) ++ return LIBRAW_NO_THUMBNAIL; + return 0; + } + else +@@ -6380,6 +6382,7 @@ void LibRaw::x3f_thumb_loader() + { + try + { ++ INT64 checked_size = x3f_thumb_size(); // This value was checked at upper level? + x3f_t *x3f = (x3f_t *)_x3f_data; + if (!x3f) + return; // No data pointer set +@@ -6397,6 +6400,12 @@ void LibRaw::x3f_thumb_loader() + imgdata.thumbnail.tcolors = 3; + if (imgdata.thumbnail.tformat == LIBRAW_THUMBNAIL_JPEG) + { ++ INT64 alloc_size = ID->data_size; ++ if ((alloc_size > 2 * checked_size) || (alloc_size > 1024LL * 1024LL * LIBRAW_MAX_THUMBNAIL_MB)) ++ throw LIBRAW_EXCEPTION_TOOBIG; ++ if(alloc_size < 64LL) ++ throw LIBRAW_EXCEPTION_IO_CORRUPT; ++ + imgdata.thumbnail.thumb = (char *)malloc(ID->data_size); + merror(imgdata.thumbnail.thumb, "LibRaw::x3f_thumb_loader()"); + memmove(imgdata.thumbnail.thumb, ID->data, ID->data_size); +@@ -6404,6 +6413,12 @@ void LibRaw::x3f_thumb_loader() + } + else if (imgdata.thumbnail.tformat == LIBRAW_THUMBNAIL_BITMAP) + { ++ INT64 alloc_size = INT64(ID->columns) * INT64(ID->rows) * 3LL; ++ if ((alloc_size > 2 * checked_size) || ++ (alloc_size > 1024LL * 1024LL * LIBRAW_MAX_THUMBNAIL_MB)) throw LIBRAW_EXCEPTION_TOOBIG; ++ if (alloc_size < 64LL) ++ throw LIBRAW_EXCEPTION_IO_CORRUPT; ++ + imgdata.thumbnail.tlength = ID->columns * ID->rows * 3; + imgdata.thumbnail.thumb = (char *)malloc(ID->columns * ID->rows * 3); + merror(imgdata.thumbnail.thumb, "LibRaw::x3f_thumb_loader()"); +@@ -6421,7 +6436,10 @@ void LibRaw::x3f_thumb_loader() + } + catch (...) + { +- // do nothing ++ // no rethrow: handled at upper level ++ imgdata.thumbnail.twidth = 0; ++ imgdata.thumbnail.theight = 0; ++ imgdata.thumbnail.tcolors = 0; + } + } + +-- +2.53.0 + diff --git a/LibRaw-CVE-2026-21413-TALOS-2026-2331.patch b/LibRaw-CVE-2026-21413-TALOS-2026-2331.patch new file mode 100644 index 0000000..5711815 --- /dev/null +++ b/LibRaw-CVE-2026-21413-TALOS-2026-2331.patch @@ -0,0 +1,24 @@ +diff -urNp LibRaw-0.19.5.orig/dcraw/dcraw.c LibRaw-0.19.5/dcraw/dcraw.c +--- LibRaw-0.19.5.orig/dcraw/dcraw.c 2026-04-28 23:52:51.314912726 +0200 ++++ LibRaw-0.19.5/dcraw/dcraw.c 2026-04-29 00:05:10.714922134 +0200 +@@ -953,7 +953,7 @@ void CLASS lossless_jpeg_load_raw() + } + if (raw_width == 3984 && (col -= 2) < 0) + col += (row--,raw_width); +- if ((unsigned) row < raw_height) RAW(row,col) = val; ++ if (((unsigned) row < raw_height) && ((unsigned) col < raw_width)) RAW(row,col) = val; + if (++col >= raw_width) + col = (row++,0); + } +diff -urNp LibRaw-0.19.5.orig/internal/dcraw_common.cpp LibRaw-0.19.5/internal/dcraw_common.cpp +--- LibRaw-0.19.5.orig/internal/dcraw_common.cpp 2026-04-28 23:52:51.315669819 +0200 ++++ LibRaw-0.19.5/internal/dcraw_common.cpp 2026-04-29 00:03:21.023739250 +0200 +@@ -1067,7 +1067,7 @@ void CLASS lossless_jpeg_load_raw() + #else + longjmp(failure, 3); + #endif +- if ((unsigned)row < raw_height) ++ if (((unsigned)row < raw_height) && ((unsigned)col < raw_width)) + RAW(row, col) = val; + if (++col >= raw_width) + col = (row++, 0); diff --git a/LibRaw.spec b/LibRaw.spec index 49961cc..9805d1c 100644 --- a/LibRaw.spec +++ b/LibRaw.spec @@ -1,8 +1,8 @@ Summary: Library for reading RAW files obtained from digital photo cameras Name: LibRaw Version: 0.19.5 -Release: 4%{?dist} -License: BSD and (CDDL or LGPLv2) +Release: 5%{?dist} +License: BSD-3-Clause and (CDDL-1.0 or LGPL-2.1-only) URL: http://www.libraw.org BuildRequires: gcc-c++ @@ -16,6 +16,9 @@ Patch0: LibRaw-0.6.0-pkgconfig.patch Patch1: LibRaw-CVE-2020-15503.patch Patch2: LibRaw-CVE-2020-24870.patch Patch3: LibRaw-CVE-2021-32142.patch +Patch4: LibRaw-CVE-2026-20889-TALOS-2026-2358.patch +Patch5: LibRaw-CVE-2026-21413-TALOS-2026-2331.patch + Provides: bundled(dcraw) = 9.25 %description @@ -58,6 +61,8 @@ LibRaw sample programs %patch1 -p1 -b .cve-2020-15503 %patch2 -p1 -b .cve-2020-24870 %patch3 -p1 -b .cve-2021-32142 +%patch4 -p1 -b .cve-2026-20889 +%patch5 -p1 -b .cve-2026-21413 %build autoreconf -if @@ -121,6 +126,11 @@ rm -fv %{buildroot}%{_libdir}/lib*.la %changelog +* Tue Apr 28 2026 Debarshi Ray - 0.19.5-5 +- Backport fixes for CVE-2026-20889 and CVE-2026-21413 from upstream +- Migrate to SPDX license +Resolves: RHEL-165404, RHEL-165408 + * Mon Oct 23 2023 Debarshi Ray - 0.19.5-4 - Backport fix for CVE-2021-32142 from upstream Resolves: RHEL-9523