From: Alex Tutubalin <lexa@lexa.ru>
Date: Sun, 1 Mar 2026 16:54:16 +0000 (+0300)
Subject: Fix for TALOS-2026-2358
X-Git-Tag: archive/raspbian/0.21.4-2+rpi1+deb13u1^2~7
X-Git-Url: https://dgit.raspbian.org/%22http://www.example.com/cgi/%22/%22http:/www.example.com/cgi/%22?a=commitdiff_plain;h=88e2c9c0e682d60c075decf2ea290eb7e1680a7c;p=libraw.git

Fix for TALOS-2026-2358

Origin: https://github.com/LibRaw/LibRaw/commit/b9809e410d07ca7bf408e6d036615fb34f8c47cc
Bug: https://talosintelligence.com/vulnerability_reports/TALOS-2026-2358
Bug-Debian: https://bugs.debian.org/1133845
Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2026-20889

Gbp-Pq: Name CVE-2026-20889.patch
---

diff --git a/src/decoders/unpack_thumb.cpp b/src/decoders/unpack_thumb.cpp
index df30da1..f79b0bb 100644
--- a/src/decoders/unpack_thumb.cpp
+++ b/src/decoders/unpack_thumb.cpp
@@ -387,6 +387,8 @@ int LibRaw::unpack_thumb(void)
       {
         x3f_thumb_loader();
         SET_PROC_FLAG(LIBRAW_PROGRESS_THUMB_LOAD);
+		if (!T.twidth && !T.theight)
+			return LIBRAW_NO_THUMBNAIL;
         return 0;
       }
 #endif
diff --git a/src/x3f/x3f_parse_process.cpp b/src/x3f/x3f_parse_process.cpp
index 354e467..9742c8e 100644
--- a/src/x3f/x3f_parse_process.cpp
+++ b/src/x3f/x3f_parse_process.cpp
@@ -322,6 +322,7 @@ void LibRaw::x3f_thumb_loader()
 {
   try
   {
+    INT64 checked_size = x3f_thumb_size(); // This value was checked at upper level?
     x3f_t *x3f = (x3f_t *)_x3f_data;
     if (!x3f)
       return; // No data pointer set
@@ -339,12 +340,24 @@ void LibRaw::x3f_thumb_loader()
     imgdata.thumbnail.tcolors = 3;
     if (imgdata.thumbnail.tformat == LIBRAW_THUMBNAIL_JPEG)
     {
-      imgdata.thumbnail.thumb = (char *)malloc(ID->data_size);
+	  INT64 alloc_size = ID->data_size;
+	  if ((alloc_size > 2 * checked_size) || (alloc_size > 1024LL * 1024LL * LIBRAW_MAX_THUMBNAIL_MB))
+		  throw LIBRAW_EXCEPTION_TOOBIG;
+	  if(alloc_size < 64LL)
+        throw LIBRAW_EXCEPTION_IO_CORRUPT;
+
+	  imgdata.thumbnail.thumb = (char *)malloc(ID->data_size);
       memmove(imgdata.thumbnail.thumb, ID->data, ID->data_size);
       imgdata.thumbnail.tlength = ID->data_size;
     }
     else if (imgdata.thumbnail.tformat == LIBRAW_THUMBNAIL_BITMAP)
     {
+      INT64 alloc_size = INT64(ID->columns) * INT64(ID->rows) * 3LL;
+	  if ((alloc_size > 2 * checked_size) ||
+          (alloc_size > 1024LL * 1024LL * LIBRAW_MAX_THUMBNAIL_MB)) throw LIBRAW_EXCEPTION_TOOBIG;
+      if (alloc_size < 64LL)
+        throw LIBRAW_EXCEPTION_IO_CORRUPT;
+
       imgdata.thumbnail.tlength = ID->columns * ID->rows * 3;
       imgdata.thumbnail.thumb = (char *)malloc(ID->columns * ID->rows * 3);
       char *src0 = (char *)ID->data;
@@ -361,7 +374,10 @@ void LibRaw::x3f_thumb_loader()
   }
   catch (...)
   {
-    // do nothing
+    // no rethrow: handled at upper level
+    imgdata.thumbnail.twidth = 0;
+    imgdata.thumbnail.theight = 0;
+    imgdata.thumbnail.tcolors = 0;
   }
 }
 
diff --git a/src/x3f/x3f_utils_patched.cpp b/src/x3f/x3f_utils_patched.cpp
index 6b20b90..21c7ab1 100644
--- a/src/x3f/x3f_utils_patched.cpp
+++ b/src/x3f/x3f_utils_patched.cpp
@@ -1221,7 +1221,14 @@ static uint32_t read_data_block(void **data, x3f_info_t *I,
   if (fpos + size > I->input.file->size())
     throw LIBRAW_EXCEPTION_IO_CORRUPT;
 
+  // All known files from real cameras are many times smaller than 1 GB, so the hard limit is OK here.
+
+  if(size > 1024*1024*1024)
+    throw LIBRAW_EXCEPTION_ALLOC;
+
   *data = (void *)malloc(size);
+  if (!*data)
+	  throw LIBRAW_EXCEPTION_ALLOC;
 
   GETN(*data, size);