From: Alex Tutubalin <lexa@lexa.ru>
Date: Tue, 17 Mar 2026 09:44:57 +0000 (+0300)
Subject: Nikon padded/12bit: no need to calculate padded row size before final raw_width adjus... 
X-Git-Tag: archive/raspbian/0.21.4-2+rpi1+deb13u1^2~1
X-Git-Url: https://dgit.raspbian.org/%22http://www.example.com/cgi/%22/%22http:/www.example.com/cgi/%22?a=commitdiff_plain;h=9de43ce79b51b66201c15a253e8388cea7674b78;p=libraw.git

Nikon padded/12bit: no need to calculate padded row size before final raw_width adjustment

Origin: https://github.com/LibRaw/LibRaw/commit/2468614a9cbcab6b75ca279ab60cac62156f7aeb
Bug: https://github.com/LibRaw/LibRaw/issues/795
Bug-Debian: https://bugs.debian.org/1132655
Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2026-5342

Gbp-Pq: Name CVE-2026-5342.patch
---

diff --git a/src/decoders/decoders_libraw.cpp b/src/decoders/decoders_libraw.cpp
index eb277c3..5a82352 100644
--- a/src/decoders/decoders_libraw.cpp
+++ b/src/decoders/decoders_libraw.cpp
@@ -259,17 +259,23 @@ void LibRaw::fuji_14bit_load_raw()
 void LibRaw::nikon_load_padded_packed_raw() // 12 bit per pixel, padded to 16
                                             // bytes
 {
+	unsigned bytesperrow = (((unsigned(S.raw_width) * 3u / 2u) + 15u) / 16u) * 16u; // bytes per row
+
   // libraw_internal_data.unpacker_data.load_flags -> row byte count
-  if (libraw_internal_data.unpacker_data.load_flags < 2000 ||
-      libraw_internal_data.unpacker_data.load_flags > 64000)
-    return;
+  if (bytesperrow < 2000 || bytesperrow > 64000)
+    throw LIBRAW_EXCEPTION_IO_CORRUPT;
+
   unsigned char *buf =
-      (unsigned char *)calloc(libraw_internal_data.unpacker_data.load_flags,1);
+      (unsigned char *)calloc(bytesperrow,1);
   for (int row = 0; row < S.raw_height; row++)
   {
     checkCancel();
-    libraw_internal_data.internal_data.input->read(
-        buf, libraw_internal_data.unpacker_data.load_flags, 1);
+    int readed = libraw_internal_data.internal_data.input->read(
+        buf, 1, bytesperrow);
+
+	if (readed < (int)bytesperrow)
+		derror();
+
     for (int icol = 0; icol < S.raw_width / 2; icol++)
     {
       imgdata.rawdata.raw_image[(row)*S.raw_width + (icol * 2)] =
diff --git a/src/metadata/tiff.cpp b/src/metadata/tiff.cpp
index 5ec07a2..5ba41ae 100644
--- a/src/metadata/tiff.cpp
+++ b/src/metadata/tiff.cpp
@@ -2031,8 +2031,6 @@ void LibRaw::apply_tiff()
                INT64(tiff_ifd[raw].bytes))
       {
         load_raw = &LibRaw::nikon_load_padded_packed_raw;
-        load_flags = (((INT64(raw_width) * 3ULL / 2ULL) + 15ULL) / 16ULL) *
-                     16ULL; // bytes per row
       }
       else if (!strncmp(model, "NIKON Z 9", 9) && tiff_ifd[raw].offset)
       {