From: Alex Tutubalin <lexa@lexa.ru>
Date: Sat, 28 Feb 2026 15:26:53 +0000 (+0300)
Subject: Fix for TALOS-2026-2331
X-Git-Tag: archive/raspbian/0.21.4-2+rpi1+deb13u1^2~8
X-Git-Url: https://dgit.raspbian.org/%22http://www.example.com/cgi/%22/%22http:/www.example.com/cgi/%22?a=commitdiff_plain;h=367ffefbec0b8f3a23dd8088b606af0ccfbea4f8;p=libraw.git

Fix for TALOS-2026-2331

Origin: https://github.com/LibRaw/LibRaw/commit/75ed2c12a35b765b3b6ad695cc1f044f19efe644
Bug: https://talosintelligence.com/vulnerability_reports/TALOS-2026-2331
Bug-Debian: https://bugs.debian.org/1133845
Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2026-21413

Gbp-Pq: Name CVE-2026-21413.patch
---

diff --git a/src/decoders/decoders_dcraw.cpp b/src/decoders/decoders_dcraw.cpp
index 183136b..fc73e6c 100644
--- a/src/decoders/decoders_dcraw.cpp
+++ b/src/decoders/decoders_dcraw.cpp
@@ -560,6 +560,7 @@ void LibRaw::lossless_jpeg_load_raw()
   if (jh.clrs == 4 && jwide >= raw_width * 2)
     jhigh *= 2;
 
+  
   try
   {
     for (jrow = 0; jrow < jh.high; jrow++)
@@ -588,7 +589,7 @@ void LibRaw::lossless_jpeg_load_raw()
           col += (row--, raw_width);
         if (row > raw_height)
           throw LIBRAW_EXCEPTION_IO_CORRUPT;
-        if ((unsigned)row < raw_height)
+        if (((unsigned)row < raw_height) && ((unsigned)col < raw_width))
           RAW(row, col) = val;
         if (++col >= raw_width)
           col = (row++, 0);