File libraw-CVE-2018-5810.patch of Package libraw.30665
--- a/internal/dcraw_common.cpp
+++ b/internal/dcraw_common.cpp
@@ -1506,7 +1511,12 @@ void CLASS rollei_thumb()
void CLASS rollei_load_raw()
{
uchar pixel[10];
- unsigned iten=0, isix, i, buffer=0, todo[16];
+ unsigned iten = 0, isix, i, buffer = 0, todo[16];
+#ifdef LIBRAW_LIBRARY_BUILD
+ if(raw_width > 32767 || raw_height > 32767)
+ throw LIBRAW_EXCEPTION_IO_BADFILE;
+#endif
+ unsigned maxpixel = raw_width*(raw_height+7);
isix = raw_width * raw_height * 5 / 8;
while (fread (pixel, 1, 10, ifp) == 10) {
@@ -1522,8 +1532,11 @@ void CLASS rollei_load_raw()
todo[i] = isix++;
todo[i+1] = buffer >> (14-i)*5;
}
- for (i=0; i < 16; i+=2)
- raw_image[todo[i]] = (todo[i+1] & 0x3ff);
+ for (i = 0; i < 16; i += 2)
+ if(todo[i] < maxpixel)
+ raw_image[todo[i]] = (todo[i + 1] & 0x3ff);
+ else
+ derror();
}
maximum = 0x3ff;
}