75 lines
2.8 KiB
Diff
75 lines
2.8 KiB
Diff
From b730c0087ec110516736c29ef2c9b67498bf6a8d Mon Sep 17 00:00:00 2001
|
|
From: Alex Tutubalin <lexa@lexa.ru>
|
|
Date: Wed, 13 May 2026 12:13:22 +0300
|
|
Subject: [PATCH] rotated fuji: stricter image size limits; raw2image(ex):
|
|
avoid possible 32-bit overflow on alloc size calculations
|
|
|
|
---
|
|
src/metadata/identify.cpp | 4 ++++
|
|
src/preprocessing/raw2image.cpp | 10 +++++-----
|
|
src/utils/phaseone_processing.cpp | 2 +-
|
|
3 files changed, 10 insertions(+), 6 deletions(-)
|
|
|
|
diff --git a/src/metadata/identify.cpp b/src/metadata/identify.cpp
|
|
index aabbf85..8dd3b22 100644
|
|
--- a/src/metadata/identify.cpp
|
|
+++ b/src/metadata/identify.cpp
|
|
@@ -1215,6 +1215,10 @@ dng_skip:
|
|
// Prevent incorrect-sized fuji-rotated files
|
|
if (INT64(width)*INT64(height) > INT64(raw_width) * INT64(raw_height) * 8LL)
|
|
is_raw = 0;
|
|
+
|
|
+ // All 'fuji-rotated' images are 6Mpix or less, so 8k x 8k limit is OK
|
|
+ if(width > 8192 || height > 8192 || raw_width > 8192 || raw_height > 8192)
|
|
+ is_raw = 0;
|
|
}
|
|
else
|
|
{
|
|
diff --git a/src/preprocessing/raw2image.cpp b/src/preprocessing/raw2image.cpp
|
|
index 702cf29..b91214f 100644
|
|
--- a/src/preprocessing/raw2image.cpp
|
|
+++ b/src/preprocessing/raw2image.cpp
|
|
@@ -76,16 +76,16 @@ int LibRaw::raw2image(void)
|
|
}
|
|
|
|
// free and re-allocate image bitmap
|
|
+ INT64 allocate_sz = INT64(S.iheight) * INT64(S.iwidth);
|
|
if (imgdata.image)
|
|
{
|
|
imgdata.image = (ushort(*)[4])realloc(
|
|
- imgdata.image, S.iheight * S.iwidth * sizeof(*imgdata.image));
|
|
- memset(imgdata.image, 0, S.iheight * S.iwidth * sizeof(*imgdata.image));
|
|
+ imgdata.image, allocate_sz * sizeof(*imgdata.image));
|
|
+ memset(imgdata.image, 0, allocate_sz * sizeof(*imgdata.image));
|
|
}
|
|
else
|
|
imgdata.image =
|
|
- (ushort(*)[4])calloc(S.iheight * S.iwidth, sizeof(*imgdata.image));
|
|
-
|
|
+ (ushort(*)[4])calloc(allocate_sz, sizeof(*imgdata.image));
|
|
|
|
libraw_decoder_info_t decoder_info;
|
|
get_decoder_info(&decoder_info);
|
|
@@ -392,7 +392,7 @@ int LibRaw::raw2image_ex(int do_subtract_black)
|
|
alloc_height = (t_alloc_height + IO.shrink) >> IO.shrink;
|
|
alloc_width = (t_alloc_width + IO.shrink) >> IO.shrink;
|
|
}
|
|
- int alloc_sz = alloc_width * alloc_height;
|
|
+ INT64 alloc_sz = INT64(alloc_width) * INT64(alloc_height);
|
|
|
|
if (imgdata.image)
|
|
{
|
|
diff --git a/src/utils/phaseone_processing.cpp b/src/utils/phaseone_processing.cpp
|
|
index b82988b..bef831d 100644
|
|
--- a/src/utils/phaseone_processing.cpp
|
|
+++ b/src/utils/phaseone_processing.cpp
|
|
@@ -21,7 +21,7 @@
|
|
void LibRaw::phase_one_allocate_tempbuffer()
|
|
{
|
|
// Allocate temp raw_image buffer
|
|
- imgdata.rawdata.raw_image = (ushort *)malloc(S.raw_pitch * S.raw_height);
|
|
+ imgdata.rawdata.raw_image = (ushort *)malloc(UINT64(S.raw_pitch) * UINT64(S.raw_height));
|
|
}
|
|
void LibRaw::phase_one_free_tempbuffer()
|
|
{
|