From 367ffefbec0b8f3a23dd8088b606af0ccfbea4f8 Mon Sep 17 00:00:00 2001 From: Alex Tutubalin Date: Sat, 28 Feb 2026 18:26:53 +0300 Subject: [PATCH] Fix for TALOS-2026-2331 Origin: https://github.com/LibRaw/LibRaw/commit/75ed2c12a35b765b3b6ad695cc1f044f19efe644 Bug: https://talosintelligence.com/vulnerability_reports/TALOS-2026-2331 Bug-Debian: https://bugs.debian.org/1133845 Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2026-21413 Gbp-Pq: Name CVE-2026-21413.patch --- src/decoders/decoders_dcraw.cpp | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/decoders/decoders_dcraw.cpp b/src/decoders/decoders_dcraw.cpp index 183136b..fc73e6c 100644 --- a/src/decoders/decoders_dcraw.cpp +++ b/src/decoders/decoders_dcraw.cpp @@ -560,6 +560,7 @@ void LibRaw::lossless_jpeg_load_raw() if (jh.clrs == 4 && jwide >= raw_width * 2) jhigh *= 2; + try { for (jrow = 0; jrow < jh.high; jrow++) @@ -588,7 +589,7 @@ void LibRaw::lossless_jpeg_load_raw() col += (row--, raw_width); if (row > raw_height) throw LIBRAW_EXCEPTION_IO_CORRUPT; - if ((unsigned)row < raw_height) + if (((unsigned)row < raw_height) && ((unsigned)col < raw_width)) RAW(row, col) = val; if (++col >= raw_width) col = (row++, 0); -- 2.30.2