From d4db20eb65b3a1eebcf4572c64eb14268d1f20e6 Mon Sep 17 00:00:00 2001 From: Debarshi Ray Date: Thu, 30 Apr 2026 15:24:20 +0200 Subject: [PATCH] Backport fix for CVE-2026-24660 from upstream This is backported from the upstream commit [1] to fit the 0.19-stable branch. [1] Commit ac151a829b8d3e4c https://github.com/LibRaw/LibRaw/commit/ac151a829b8d3e4c Resolves: RHEL-165412 --- LibRaw-CVE-2026-24660-TALOS-2026-2359.patch | 334 ++++++++++++++++++++ LibRaw.spec | 8 +- 2 files changed, 341 insertions(+), 1 deletion(-) create mode 100644 LibRaw-CVE-2026-24660-TALOS-2026-2359.patch diff --git a/LibRaw-CVE-2026-24660-TALOS-2026-2359.patch b/LibRaw-CVE-2026-24660-TALOS-2026-2359.patch new file mode 100644 index 0000000..e0eb689 --- /dev/null +++ b/LibRaw-CVE-2026-24660-TALOS-2026-2359.patch @@ -0,0 +1,334 @@ +From 92492c81b2fd2b600f357b32a1e03bff85db65b9 Mon Sep 17 00:00:00 2001 +From: Debarshi Ray +Date: Thu, 30 Apr 2026 14:27:27 +0200 +Subject: [PATCH] X3F decoder: implemented hard single allocation limit + +... via LIBRAW_X3F_ALLOC_LIMIT_MB define; allocation size calculation +converted to 64 bit arithm; fix for TALOS-2026-2359. + +(backported from commit ac151a829b8d3e4c74fa3aefa8a029c3cc3f857f) +--- + internal/libraw_x3f.cpp | 101 ++++++++++++++++++++++++---------------- + libraw/libraw_const.h | 6 +++ + 2 files changed, 67 insertions(+), 40 deletions(-) + +diff --git a/internal/libraw_x3f.cpp b/internal/libraw_x3f.cpp +index 2976eaf70929..8b159dda18c9 100644 +--- a/internal/libraw_x3f.cpp ++++ b/internal/libraw_x3f.cpp +@@ -474,6 +474,36 @@ x3f_return_t x3f_delete(x3f_t *x3f); + /* Reading and writing - assuming little endian in the file */ + /* --------------------------------------------------------------------- */ + ++static void *x3f_limited_malloc(UINT64 sz) ++{ ++ if (sz > LIBRAW_X3F_ALLOC_LIMIT_MB * 1024ULL * 1024ULL) ++ throw LIBRAW_EXCEPTION_TOOBIG; ++ void *ret = malloc(sz); ++ if (!ret) ++ throw LIBRAW_EXCEPTION_ALLOC; ++ return ret; ++} ++ ++static void *x3f_limited_calloc(UINT64 n, UINT64 sz) ++{ ++ if (sz * n > LIBRAW_X3F_ALLOC_LIMIT_MB * 1024ULL * 1024ULL) ++ throw LIBRAW_EXCEPTION_TOOBIG; ++ void *ret = calloc(n, sz); ++ if (!ret) ++ throw LIBRAW_EXCEPTION_ALLOC; ++ return ret; ++} ++ ++static void *x3f_limited_realloc(void *ptr, UINT64 sz) ++{ ++ if (sz > LIBRAW_X3F_ALLOC_LIMIT_MB * 1024ULL * 1024ULL) ++ throw LIBRAW_EXCEPTION_TOOBIG; ++ void *ret = realloc(ptr, sz); ++ if (!ret) ++ throw LIBRAW_EXCEPTION_ALLOC; ++ return ret; ++} ++ + static int x3f_get1(LibRaw_abstract_datastream *f) + { + /* Little endian file */ +@@ -536,7 +566,7 @@ union {int32_t i; float f;} _tmp; \ + do { \ + int _i; \ + (_T).size = (_NUM); \ +- (_T).element = (_TYPE *)realloc((_T).element, \ ++ (_T).element = (_TYPE *)x3f_limited_realloc((_T).element, \ + (_NUM)*sizeof((_T).element[0])); \ + for (_i = 0; _i < (_T).size; _i++) \ + _GETX((_T).element[_i]); \ +@@ -546,7 +576,7 @@ union {int32_t i; float f;} _tmp; \ + do { \ + int _i; \ + (_T).size = (_NUM); \ +- (_T).element = (x3f_property_t *)realloc((_T).element, \ ++ (_T).element = (x3f_property_t *)x3f_limited_realloc((_T).element, \ + (_NUM)*sizeof((_T).element[0])); \ + for (_i = 0; _i < (_T).size; _i++) { \ + GET4((_T).element[_i].name_offset); \ +@@ -560,7 +590,7 @@ union {int32_t i; float f;} _tmp; \ + (_T).element = NULL; \ + for (_i = 0; ; _i++) { \ + (_T).size = _i + 1; \ +- (_T).element = (x3f_true_huffman_element_t *)realloc((_T).element, \ ++ (_T).element = (x3f_true_huffman_element_t *)x3f_limited_realloc((_T).element, \ + (_i + 1)*sizeof((_T).element[0])); \ + GET1((_T).element[_i].code_size); \ + GET1((_T).element[_i].code); \ +@@ -583,7 +613,7 @@ static void new_huffman_tree(x3f_hufftree_t *HTP, int bits) + + HTP->free_node_index = 0; + HTP->nodes = (x3f_huffnode_t *) +- calloc(1, HUF_TREE_MAX_NODES(leaves)*sizeof(x3f_huffnode_t)); ++ x3f_limited_calloc(1, HUF_TREE_MAX_NODES(leaves)*sizeof(x3f_huffnode_t)); + } + + /* --------------------------------------------------------------------- */ +@@ -608,7 +638,7 @@ static void cleanup_true(x3f_true_t **TRUP) + + static x3f_true_t *new_true(x3f_true_t **TRUP) + { +- x3f_true_t *TRU = (x3f_true_t *)calloc(1, sizeof(x3f_true_t)); ++ x3f_true_t *TRU = (x3f_true_t *)x3f_limited_calloc(1, sizeof(x3f_true_t)); + + cleanup_true(TRUP); + +@@ -639,7 +669,7 @@ static void cleanup_quattro(x3f_quattro_t **QP) + + static x3f_quattro_t *new_quattro(x3f_quattro_t **QP) + { +- x3f_quattro_t *Q = (x3f_quattro_t *)calloc(1, sizeof(x3f_quattro_t)); ++ x3f_quattro_t *Q = (x3f_quattro_t *)x3f_limited_calloc(1, sizeof(x3f_quattro_t)); + int i; + + cleanup_quattro(QP); +@@ -682,7 +712,7 @@ static void cleanup_huffman(x3f_huffman_t **HUFP) + + static x3f_huffman_t *new_huffman(x3f_huffman_t **HUFP) + { +- x3f_huffman_t *HUF = (x3f_huffman_t *)calloc(1, sizeof(x3f_huffman_t)); ++ x3f_huffman_t *HUF = (x3f_huffman_t *)x3f_limited_calloc(1, sizeof(x3f_huffman_t)); + + cleanup_huffman(HUFP); + +@@ -712,9 +742,7 @@ static x3f_huffman_t *new_huffman(x3f_huffman_t **HUFP) + { + if (!infile) return NULL; + INT64 fsize = infile->size(); +- x3f_t *x3f = (x3f_t *)calloc(1, sizeof(x3f_t)); +- if(!x3f) +- throw LIBRAW_EXCEPTION_ALLOC; ++ x3f_t *x3f = (x3f_t *)x3f_limited_calloc(1, sizeof(x3f_t)); + try { + x3f_info_t *I = NULL; + x3f_header_t *H = NULL; +@@ -773,7 +801,7 @@ static x3f_huffman_t *new_huffman(x3f_huffman_t **HUFP) + + if (DS->num_directory_entries > 0) { + size_t size = DS->num_directory_entries * sizeof(x3f_directory_entry_t); +- DS->directory_entry = (x3f_directory_entry_t *)calloc(1, size); ++ DS->directory_entry = (x3f_directory_entry_t *)x3f_limited_calloc(1, size); + } + + /* Traverse the directory */ +@@ -1579,14 +1607,7 @@ static uint32_t read_data_block(void **data, + if (fpos + size > I->input.file->size()) + throw LIBRAW_EXCEPTION_IO_CORRUPT; + +- // All known files from real cameras are many times smaller than 1 GB, so the hard limit is OK here. +- +- if(size > 1024*1024*1024) +- throw LIBRAW_EXCEPTION_ALLOC; +- +- *data = (void *)malloc(size); +- if (!*data) +- throw LIBRAW_EXCEPTION_ALLOC; ++ *data = (void *)x3f_limited_malloc(size); + + GETN(*data, size); + +@@ -1719,35 +1740,35 @@ static void x3f_load_true(x3f_info_t *I, + uint32_t columns = Q->plane[0].columns; + uint32_t rows = Q->plane[0].rows; + uint32_t channels = 3; +- uint32_t size = columns * rows * channels; ++ UINT64 size = UINT64(columns) * UINT64(rows) * UINT64(channels); + + TRU->x3rgb16.columns = columns; + TRU->x3rgb16.rows = rows; + TRU->x3rgb16.channels = channels; + TRU->x3rgb16.row_stride = columns * channels; +- TRU->x3rgb16.buf = malloc(sizeof(uint16_t)*size); ++ TRU->x3rgb16.buf = x3f_limited_malloc(sizeof(uint16_t)*size); + TRU->x3rgb16.data = (uint16_t *) TRU->x3rgb16.buf; + + columns = Q->plane[2].columns; + rows = Q->plane[2].rows; + channels = 1; +- size = columns * rows * channels; ++ size = UINT64(columns) * UINT64(rows) * UINT64(channels); + + Q->top16.columns = columns; + Q->top16.rows = rows; + Q->top16.channels = channels; + Q->top16.row_stride = columns * channels; +- Q->top16.buf = malloc(sizeof(uint16_t)*size); ++ Q->top16.buf = x3f_limited_malloc(sizeof(uint16_t)*size); + Q->top16.data = (uint16_t *)Q->top16.buf; + + } else { +- uint32_t size = ID->columns * ID->rows * 3; ++ UINT64 size = UINT64(ID->columns) * UINT64(ID->rows) * 3ULL; + + TRU->x3rgb16.columns = ID->columns; + TRU->x3rgb16.rows = ID->rows; + TRU->x3rgb16.channels = 3; + TRU->x3rgb16.row_stride = ID->columns * 3; +- TRU->x3rgb16.buf =malloc(sizeof(uint16_t)*size); ++ TRU->x3rgb16.buf = x3f_limited_malloc(sizeof(uint16_t)*size); + TRU->x3rgb16.data = (uint16_t *)TRU->x3rgb16.buf; + } + +@@ -1802,7 +1823,7 @@ static void x3f_load_huffman(x3f_info_t *I, + x3f_directory_entry_header_t *DEH = &DE->header; + x3f_image_data_t *ID = &DEH->data_subsection.image_data; + x3f_huffman_t *HUF = new_huffman(&ID->huffman); +- uint32_t size; ++ UINT64 size; + + if (use_map_table) { + int table_size = 1<type_format) { + case X3F_IMAGE_RAW_HUFFMAN_X530: + case X3F_IMAGE_RAW_HUFFMAN_10BIT: +- size = ID->columns * ID->rows * 3; ++ size = UINT64(ID->columns) * UINT64(ID->rows) * 3ULL; + HUF->x3rgb16.columns = ID->columns; + HUF->x3rgb16.rows = ID->rows; + HUF->x3rgb16.channels = 3; + HUF->x3rgb16.row_stride = ID->columns * 3; +- HUF->x3rgb16.buf = malloc(sizeof(uint16_t)*size); ++ HUF->x3rgb16.buf = x3f_limited_malloc(sizeof(uint16_t)*size); + HUF->x3rgb16.data = (uint16_t *)HUF->x3rgb16.buf; + break; + case X3F_IMAGE_THUMB_HUFFMAN: +- size = ID->columns * ID->rows * 3; ++ size = UINT64(ID->columns) * UINT64(ID->rows) * 3ULL; + HUF->rgb8.columns = ID->columns; + HUF->rgb8.rows = ID->rows; + HUF->rgb8.channels = 3; + HUF->rgb8.row_stride = ID->columns * 3; +- HUF->rgb8.buf = malloc(sizeof(uint8_t)*size); ++ HUF->rgb8.buf = x3f_limited_malloc(sizeof(uint8_t)*size); + HUF->rgb8.data = (uint8_t *)HUF->rgb8.buf; + break; + default: +@@ -1923,7 +1944,7 @@ static void x3f_load_camf_decode_type2(x3f_camf_t *CAMF) + int i; + + CAMF->decoded_data_size = CAMF->data_size; +- CAMF->decoded_data = malloc(CAMF->decoded_data_size); ++ CAMF->decoded_data = x3f_limited_malloc(CAMF->decoded_data_size); + + for (i=0; idata_size; i++) { + uint8_t old, _new; +@@ -1963,7 +1984,7 @@ static void camf_decode_type4(x3f_camf_t *CAMF) + + CAMF->decoded_data_size = dst_size; + +- CAMF->decoded_data = malloc(CAMF->decoded_data_size); ++ CAMF->decoded_data = x3f_limited_malloc(CAMF->decoded_data_size); + memset(CAMF->decoded_data, 0, CAMF->decoded_data_size); + + dst = (uint8_t *)CAMF->decoded_data; +@@ -2038,7 +2059,7 @@ static void x3f_load_camf_decode_type4(x3f_camf_t *CAMF) + for (i=0, p = (uint8_t*)CAMF->data; *p != 0; i++) { + /* TODO: Is this too expensive ??*/ + element = +- (x3f_true_huffman_element_t *)realloc(element, (i+1)*sizeof(*element)); ++ (x3f_true_huffman_element_t *)x3f_limited_realloc(element, (i+1)*sizeof(*element)); + + element[i].code_size = *p++; + element[i].code = *p++; +@@ -2077,7 +2098,7 @@ static void camf_decode_type5(x3f_camf_t *CAMF) + int32_t i; + + CAMF->decoded_data_size = CAMF->t5.decoded_data_size; +- CAMF->decoded_data = malloc(CAMF->decoded_data_size); ++ CAMF->decoded_data = x3f_limited_malloc(CAMF->decoded_data_size); + + dst = (uint8_t *)CAMF->decoded_data; + +@@ -2100,7 +2121,7 @@ static void x3f_load_camf_decode_type5(x3f_camf_t *CAMF) + for (i=0, p = (uint8_t*)CAMF->data; *p != 0; i++) { + /* TODO: Is this too expensive ??*/ + element = +- (x3f_true_huffman_element_t *)realloc(element, (i+1)*sizeof(*element)); ++ (x3f_true_huffman_element_t *)x3f_limited_realloc(element, (i+1)*sizeof(*element)); + + element[i].code_size = *p++; + element[i].code = *p++; +@@ -2144,8 +2165,8 @@ static void x3f_setup_camf_property_entry(camf_entry_t *entry) + entry->property_num = *(uint32_t *)v; + uint32_t off = *(uint32_t *)(v + 4); + +- entry->property_name = (char **)malloc(num*sizeof(uint8_t*)); +- entry->property_value = (uint8_t **)malloc(num*sizeof(uint8_t*)); ++ entry->property_name = (char **)x3f_limited_malloc(num*sizeof(uint8_t*)); ++ entry->property_value = (uint8_t **)x3f_limited_malloc(num*sizeof(uint8_t*)); + + for (i=0; imatrix_decoded = malloc(size); ++ entry->matrix_decoded = x3f_limited_malloc(size); + + switch (element_size) { + case 4: +@@ -2271,7 +2292,7 @@ static void x3f_setup_camf_matrix_entry(camf_entry_t *entry) + entry->matrix_data_off = *(uint32_t *)(v + 8); + camf_dim_entry_t *dentry = + entry->matrix_dim_entry = +- (camf_dim_entry_t*)malloc(dim*sizeof(camf_dim_entry_t)); ++ (camf_dim_entry_t*)x3f_limited_malloc(dim*sizeof(camf_dim_entry_t)); + + for (i=0; i - 0.19.5-6 +- Backport fix for CVE-2026-24660 from upstream +Resolves: RHEL-165412 + * Tue Apr 28 2026 Debarshi Ray - 0.19.5-5 - Backport fixes for CVE-2026-20889 and CVE-2026-21413 from upstream - Migrate to SPDX license