Fix for TALOS-2026-2363: avoid integer overflow in allocation size calculation. Also...

Origin: https://github.com/LibRaw/LibRaw/commit/c911c9b9edffa5fab99f828d0fee6dd2d0f6105f
Bug: https://talosintelligence.com/vulnerability_reports/TALOS-2026-2363
Bug-Debian: https://bugs.debian.org/1133845
Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2026-24450

Gbp-Pq: Name CVE-2026-24450.patch

diff --git a/src/decoders/fp_dng.cpp b/src/decoders/fp_dng.cpp
index df7fe6c2315822ea908f7ea86a3d8f4ea9c8916c..4bb8f426290cb17aa35cabd45a6595bd51d12452 100644 (file)
--- a/src/decoders/fp_dng.cpp
+++ b/src/decoders/fp_dng.cpp
@@ -611,12 +611,17 @@ void LibRaw::uncompressed_fp_dng_load_raw()
     tiles.init(ifd, imgdata.sizes, libraw_internal_data.unpacker_data, libraw_internal_data.unpacker_data.order,
         libraw_internal_data.internal_data.input);
 
+       // Max bytes: 2^16 raw width * 2^2 bytes/pixel * 2^2 channels = 2^20, so check against 2^22
+       INT64 rowbytes = INT64(MAX(tiles.tileWidth, imgdata.sizes.raw_width)) * INT64(MAX(bytesps,4)) * INT64(ifd->samples);
+       if(rowbytes > (1LL << 22))
+      throw LIBRAW_EXCEPTION_TOOBIG;
+
        INT64 allocsz = INT64(tiles.tileCnt) * INT64(tiles.tileWidth) * INT64(tiles.tileHeight) * INT64(ifd->samples) * INT64(sizeof(float));
        if (allocsz > INT64(imgdata.rawparams.max_raw_memory_mb) * INT64(1024 * 1024))
                throw LIBRAW_EXCEPTION_TOOBIG;
 
     if (ifd->sample_format == 3)
-        float_raw_image = (float *)calloc(tiles.tileCnt * tiles.tileWidth * tiles.tileHeight *ifd->samples, sizeof(float));
+        float_raw_image = (float *)calloc(allocsz,1);
     else
         throw LIBRAW_EXCEPTION_DECODE_RAW; // Only float supported
 
@@ -633,6 +638,7 @@ void LibRaw::uncompressed_fp_dng_load_raw()
             size_t rowsInTile = y + tiles.tileHeight > imgdata.sizes.raw_height ? imgdata.sizes.raw_height - y : tiles.tileHeight;
             size_t colsInTile = x + tiles.tileWidth > imgdata.sizes.raw_width ? imgdata.sizes.raw_width - x : tiles.tileWidth;
 
+                       // inrowbytes is less then 2^22 (see above) so conversion to int is safe
             size_t inrowbytes = colsInTile * bytesps * ifd->samples;
             int fullrowbytes = tiles.tileWidth *bytesps * ifd->samples;
             size_t outrowbytes = colsInTile * sizeof(float) * ifd->samples;
@@ -642,7 +648,9 @@ void LibRaw::uncompressed_fp_dng_load_raw()
                 unsigned char *dst = fullrowbytes > inrowbytes ? rowbuf.data(): // last tile in row, use buffer
                     (unsigned char *)&float_raw_image
                     [((y + row) * imgdata.sizes.raw_width + x) * ifd->samples];
-                libraw_internal_data.internal_data.input->read(dst, 1, fullrowbytes);
+                int bytesread = libraw_internal_data.internal_data.input->read(dst, 1, fullrowbytes);
+                               if (bytesread < fullrowbytes)
+                                       derror();
                 if (bytesps == 2 && difford)
                     libraw_swab(dst, fullrowbytes);
                 else if (bytesps == 3 && (libraw_internal_data.unpacker_data.order == 0x4949)) // II-16bit