Nikon padded/12bit: no need to calculate padded row size before final raw_width adjus...

Origin: https://github.com/LibRaw/LibRaw/commit/2468614a9cbcab6b75ca279ab60cac62156f7aeb
Bug: https://github.com/LibRaw/LibRaw/issues/795
Bug-Debian: https://bugs.debian.org/1132655
Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2026-5342

Gbp-Pq: Name CVE-2026-5342.patch

diff --git a/src/decoders/decoders_libraw.cpp b/src/decoders/decoders_libraw.cpp
index eb277c3ff11c2b91cf4d2b85231151544b56da04..5a823525af552d6a6af459b2b5c24c5e1c7c362a 100644 (file)
--- a/src/decoders/decoders_libraw.cpp
+++ b/src/decoders/decoders_libraw.cpp
@@ -259,17 +259,23 @@ void LibRaw::fuji_14bit_load_raw()
 void LibRaw::nikon_load_padded_packed_raw() // 12 bit per pixel, padded to 16
                                             // bytes
 {
+       unsigned bytesperrow = (((unsigned(S.raw_width) * 3u / 2u) + 15u) / 16u) * 16u; // bytes per row
+
   // libraw_internal_data.unpacker_data.load_flags -> row byte count
-  if (libraw_internal_data.unpacker_data.load_flags < 2000 ||
-      libraw_internal_data.unpacker_data.load_flags > 64000)
-    return;
+  if (bytesperrow < 2000 || bytesperrow > 64000)
+    throw LIBRAW_EXCEPTION_IO_CORRUPT;
+
   unsigned char *buf =
-      (unsigned char *)calloc(libraw_internal_data.unpacker_data.load_flags,1);
+      (unsigned char *)calloc(bytesperrow,1);
   for (int row = 0; row < S.raw_height; row++)
   {
     checkCancel();
-    libraw_internal_data.internal_data.input->read(
-        buf, libraw_internal_data.unpacker_data.load_flags, 1);
+    int readed = libraw_internal_data.internal_data.input->read(
+        buf, 1, bytesperrow);
+
+       if (readed < (int)bytesperrow)
+               derror();
+
     for (int icol = 0; icol < S.raw_width / 2; icol++)
     {
       imgdata.rawdata.raw_image[(row)*S.raw_width + (icol * 2)] =

diff --git a/src/metadata/tiff.cpp b/src/metadata/tiff.cpp
index 5ec07a20588004af33d7b04ca3addd2b3e690bfe..5ba41aee84ef1b19aaffe0bc21135b94e2f81811 100644 (file)
--- a/src/metadata/tiff.cpp
+++ b/src/metadata/tiff.cpp
@@ -2031,8 +2031,6 @@ void LibRaw::apply_tiff()
                INT64(tiff_ifd[raw].bytes))
       {
         load_raw = &LibRaw::nikon_load_padded_packed_raw;
-        load_flags = (((INT64(raw_width) * 3ULL / 2ULL) + 15ULL) / 16ULL) *
-                     16ULL; // bytes per row
       }
       else if (!strncmp(model, "NIKON Z 9", 9) && tiff_ifd[raw].offset)
       {