From: Alex Tutubalin <lexa@lexa.ru>
Date: Sun, 28 Dec 2025 16:18:36 +0000 (+0300)
Subject: implemented RAW size limit check and allocation result check for 4-shot pentax loaded... 
X-Git-Tag: archive/raspbian/0.21.4-2+rpi1+deb13u1^2~4
X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=901bb564aa6f1cbb1138d49dfde0c7b44f13d65b;p=libraw.git

implemented RAW size limit check and allocation result check for 4-shot pentax loaded and FP-dng loader

Origin: https://github.com/LibRaw/LibRaw/commit/afba34ec30bf6409891dc096f6be69155ecf6bdb
Bug: https://talosintelligence.com/vulnerability_reports/TALOS-2026-2364
Bug-Debian: https://bugs.debian.org/1133845
Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2026-20884

Gbp-Pq: Topic CVE-2026-20884
Gbp-Pq: Name 01-afba34ec3.patch
---

diff --git a/src/decoders/decoders_libraw.cpp b/src/decoders/decoders_libraw.cpp
index 952e41a..eb277c3 100644
--- a/src/decoders/decoders_libraw.cpp
+++ b/src/decoders/decoders_libraw.cpp
@@ -54,6 +54,10 @@ void LibRaw::sony_arq_load_raw()
 
 void LibRaw::pentax_4shot_load_raw()
 {
+  size_t alloc_sz = size_t(imgdata.sizes.raw_width) * (size_t(imgdata.sizes.raw_height) + 16) * 4 * sizeof(ushort);
+  if (INT64(alloc_sz) > INT64(imgdata.rawparams.max_raw_memory_mb) * INT64(1024 * 1024))
+    throw LIBRAW_EXCEPTION_TOOBIG;
+
 #ifdef LIBRAW_CALLOC_RAWSTORE
   ushort *plane = (ushort *)calloc(size_t(imgdata.sizes.raw_width) *
                                    size_t(imgdata.sizes.raw_height), sizeof(ushort));
@@ -61,13 +65,17 @@ void LibRaw::pentax_4shot_load_raw()
   ushort *plane = (ushort *)malloc(size_t(imgdata.sizes.raw_width) *
                                    size_t(imgdata.sizes.raw_height) * sizeof(ushort));
 #endif
-  int alloc_sz = imgdata.sizes.raw_width * (imgdata.sizes.raw_height + 16) * 4 *
-                 sizeof(ushort);
+  if (!plane)
+    throw LIBRAW_EXCEPTION_ALLOC;
+
 #ifdef LIBRAW_CALLOC_RAWSTORE
   ushort(*result)[4] = (ushort(*)[4])calloc(alloc_sz,1);
 #else
   ushort(*result)[4] = (ushort(*)[4])malloc(alloc_sz);
 #endif
+  if(!result)
+    throw LIBRAW_EXCEPTION_ALLOC;
+
   struct movement_t
   {
     int row, col;
diff --git a/src/decoders/fp_dng.cpp b/src/decoders/fp_dng.cpp
index 4bb8f42..6f82e89 100644
--- a/src/decoders/fp_dng.cpp
+++ b/src/decoders/fp_dng.cpp
@@ -350,7 +350,14 @@ void LibRaw::deflate_dng_load_raw()
       libraw_internal_data.internal_data.input);
 
   if (ifd->sample_format == 3)
-      float_raw_image = (float *)calloc(tiles.tileCnt * tiles.tileWidth * tiles.tileHeight *ifd->samples, sizeof(float));
+  {
+    INT64 raw_bytes = tiles.tileCnt * tiles.tileWidth * tiles.tileHeight * ifd->samples * sizeof(float);
+    if (raw_bytes > INT64(imgdata.rawparams.max_raw_memory_mb) * INT64(1024 * 1024))
+      throw LIBRAW_EXCEPTION_TOOBIG;
+    float_raw_image = (float *)calloc(tiles.tileCnt * tiles.tileWidth * tiles.tileHeight * ifd->samples, sizeof(float));
+    if (!float_raw_image)
+      throw LIBRAW_EXCEPTION_ALLOC;
+  }
   else
     throw LIBRAW_EXCEPTION_DECODE_RAW; // Only float deflated supported