LibRaw/CVE-2025-43964.patch
starlet-dx ce301c57b1 Fix CVE-2025-43961,CVE-2025-43962 and CVE-2025-43964
(cherry picked from commit 923f6434029482e74c79ebe1c191a1bebe7f9719)
2025-04-24 20:42:36 +08:00

23 lines
924 B
Diff

From a50dc3f1127d2e37a9b39f57ad9bb2ebb60f18c0 Mon Sep 17 00:00:00 2001
From: Alex Tutubalin <lexa@lexa.ru>
Date: Sun, 2 Mar 2025 11:35:43 +0300
Subject: [PATCH] additional checks in PhaseOne correction tag 0x412 processing
---
src/decoders/load_mfbacks.cpp | 2 ++
1 file changed, 2 insertions(+)
diff --git a/src/decoders/load_mfbacks.cpp b/src/decoders/load_mfbacks.cpp
index f89aecce..95015d27 100644
--- a/src/decoders/load_mfbacks.cpp
+++ b/src/decoders/load_mfbacks.cpp
@@ -495,6 +495,8 @@ int LibRaw::phase_one_correct()
unsigned w0 = head[1] * head[3], w1 = head[2] * head[4];
if (w0 > 10240000 || w1 > 10240000)
throw LIBRAW_EXCEPTION_ALLOC;
+ if (w0 < 1 || w1 < 1)
+ throw LIBRAW_EXCEPTION_IO_CORRUPT;
yval[0] = (float *)calloc(head[1] * head[3] + head[2] * head[4], 6);
yval[1] = (float *)(yval[0] + head[1] * head[3]);
xval[0] = (ushort *)(yval[1] + head[2] * head[4]);