implemented RAW size limit check and allocation result check for 4-shot pentax loaded...

Origin: https://github.com/LibRaw/LibRaw/commit/afba34ec30bf6409891dc096f6be69155ecf6bdb
Bug: https://talosintelligence.com/vulnerability_reports/TALOS-2026-2364
Bug-Debian: https://bugs.debian.org/1133845
Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2026-20884

Gbp-Pq: Topic CVE-2026-20884
Gbp-Pq: Name 01-afba34ec3.patch

diff --git a/src/decoders/decoders_libraw.cpp b/src/decoders/decoders_libraw.cpp
index 952e41a63d805d456fbaf9e6021e60f5e503b9a4..eb277c3ff11c2b91cf4d2b85231151544b56da04 100644 (file)
--- a/src/decoders/decoders_libraw.cpp
+++ b/src/decoders/decoders_libraw.cpp
@@ -54,6 +54,10 @@ void LibRaw::sony_arq_load_raw()
 
 void LibRaw::pentax_4shot_load_raw()
 {
+  size_t alloc_sz = size_t(imgdata.sizes.raw_width) * (size_t(imgdata.sizes.raw_height) + 16) * 4 * sizeof(ushort);
+  if (INT64(alloc_sz) > INT64(imgdata.rawparams.max_raw_memory_mb) * INT64(1024 * 1024))
+    throw LIBRAW_EXCEPTION_TOOBIG;
+
 #ifdef LIBRAW_CALLOC_RAWSTORE
   ushort *plane = (ushort *)calloc(size_t(imgdata.sizes.raw_width) *
                                    size_t(imgdata.sizes.raw_height), sizeof(ushort));
@@ -61,13 +65,17 @@ void LibRaw::pentax_4shot_load_raw()
   ushort *plane = (ushort *)malloc(size_t(imgdata.sizes.raw_width) *
                                    size_t(imgdata.sizes.raw_height) * sizeof(ushort));
 #endif
-  int alloc_sz = imgdata.sizes.raw_width * (imgdata.sizes.raw_height + 16) * 4 *
-                 sizeof(ushort);
+  if (!plane)
+    throw LIBRAW_EXCEPTION_ALLOC;
+
 #ifdef LIBRAW_CALLOC_RAWSTORE
   ushort(*result)[4] = (ushort(*)[4])calloc(alloc_sz,1);
 #else
   ushort(*result)[4] = (ushort(*)[4])malloc(alloc_sz);
 #endif
+  if(!result)
+    throw LIBRAW_EXCEPTION_ALLOC;
+
   struct movement_t
   {
     int row, col;

diff --git a/src/decoders/fp_dng.cpp b/src/decoders/fp_dng.cpp
index 4bb8f426290cb17aa35cabd45a6595bd51d12452..6f82e896ca22b887bdb2fa6f6d0b9713ec51a7de 100644 (file)
--- a/src/decoders/fp_dng.cpp
+++ b/src/decoders/fp_dng.cpp
@@ -350,7 +350,14 @@ void LibRaw::deflate_dng_load_raw()
       libraw_internal_data.internal_data.input);
 
   if (ifd->sample_format == 3)
-      float_raw_image = (float *)calloc(tiles.tileCnt * tiles.tileWidth * tiles.tileHeight *ifd->samples, sizeof(float));
+  {
+    INT64 raw_bytes = tiles.tileCnt * tiles.tileWidth * tiles.tileHeight * ifd->samples * sizeof(float);
+    if (raw_bytes > INT64(imgdata.rawparams.max_raw_memory_mb) * INT64(1024 * 1024))
+      throw LIBRAW_EXCEPTION_TOOBIG;
+    float_raw_image = (float *)calloc(tiles.tileCnt * tiles.tileWidth * tiles.tileHeight * ifd->samples, sizeof(float));
+    if (!float_raw_image)
+      throw LIBRAW_EXCEPTION_ALLOC;
+  }
   else
     throw LIBRAW_EXCEPTION_DECODE_RAW; // Only float deflated supported