From 9de43ce79b51b66201c15a253e8388cea7674b78 Mon Sep 17 00:00:00 2001 From: Alex Tutubalin Date: Tue, 17 Mar 2026 12:44:57 +0300 Subject: [PATCH] Nikon padded/12bit: no need to calculate padded row size before final raw_width adjustment Origin: https://github.com/LibRaw/LibRaw/commit/2468614a9cbcab6b75ca279ab60cac62156f7aeb Bug: https://github.com/LibRaw/LibRaw/issues/795 Bug-Debian: https://bugs.debian.org/1132655 Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2026-5342 Gbp-Pq: Name CVE-2026-5342.patch --- src/decoders/decoders_libraw.cpp | 18 ++++++++++++------ src/metadata/tiff.cpp | 2 -- 2 files changed, 12 insertions(+), 8 deletions(-) diff --git a/src/decoders/decoders_libraw.cpp b/src/decoders/decoders_libraw.cpp index eb277c3..5a82352 100644 --- a/src/decoders/decoders_libraw.cpp +++ b/src/decoders/decoders_libraw.cpp @@ -259,17 +259,23 @@ void LibRaw::fuji_14bit_load_raw() void LibRaw::nikon_load_padded_packed_raw() // 12 bit per pixel, padded to 16 // bytes { + unsigned bytesperrow = (((unsigned(S.raw_width) * 3u / 2u) + 15u) / 16u) * 16u; // bytes per row + // libraw_internal_data.unpacker_data.load_flags -> row byte count - if (libraw_internal_data.unpacker_data.load_flags < 2000 || - libraw_internal_data.unpacker_data.load_flags > 64000) - return; + if (bytesperrow < 2000 || bytesperrow > 64000) + throw LIBRAW_EXCEPTION_IO_CORRUPT; + unsigned char *buf = - (unsigned char *)calloc(libraw_internal_data.unpacker_data.load_flags,1); + (unsigned char *)calloc(bytesperrow,1); for (int row = 0; row < S.raw_height; row++) { checkCancel(); - libraw_internal_data.internal_data.input->read( - buf, libraw_internal_data.unpacker_data.load_flags, 1); + int readed = libraw_internal_data.internal_data.input->read( + buf, 1, bytesperrow); + + if (readed < (int)bytesperrow) + derror(); + for (int icol = 0; icol < S.raw_width / 2; icol++) { imgdata.rawdata.raw_image[(row)*S.raw_width + (icol * 2)] = diff --git a/src/metadata/tiff.cpp b/src/metadata/tiff.cpp index 5ec07a2..5ba41ae 100644 --- a/src/metadata/tiff.cpp +++ b/src/metadata/tiff.cpp @@ -2031,8 +2031,6 @@ void LibRaw::apply_tiff() INT64(tiff_ifd[raw].bytes)) { load_raw = &LibRaw::nikon_load_padded_packed_raw; - load_flags = (((INT64(raw_width) * 3ULL / 2ULL) + 15ULL) / 16ULL) * - 16ULL; // bytes per row } else if (!strncmp(model, "NIKON Z 9", 9) && tiff_ifd[raw].offset) { -- 2.30.2