pool/libraw
SHA256
4
0
Fork 1
Code Issues Pull Requests Packages Projects Releases Wiki Activity

- add libraw-CVE-2017-14348.patch [bsc#1058467]

Browse Source 
OBS-URL: https://build.opensuse.org/package/show/graphics/libraw?expand=0&rev=97
This commit is contained in:
Petr Gajdos 2017-09-15 10:16:13 +00:00 committed by Git OBS Bridge
parent cb174e895e
commit 76376ed0fa
3 changed files with 25 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
libraw-CVE-2017-14348.patch Normal file
View File

@ -0,0 +1,22 @@
diff --git a/internal/dcraw_common.cpp b/internal/dcraw_common.cpp
index 18bcdbcb..8fb2b073 100644
--- a/internal/dcraw_common.cpp
+++ b/internal/dcraw_common.cpp
@@ -3240,8 +3240,15 @@ void CLASS kodak_65000_load_raw()
len = MIN (256, width-col);
ret = kodak_65000_decode (buf, len);
for (i=0; i < len; i++)
- if ((RAW(row,col+i) = curve[ret ? buf[i] :
- (pred[i & 1] += buf[i])]) >> 12) derror();
+ {
+ int idx = ret ? buf[i] : (pred[i & 1] += buf[i]);
+ if(idx >=0 && idx <= 0xffff)
+ {
+ if ((RAW(row,col+i) = curve[idx]) >> 12) derror();
+ }
+ else
+ derror();
+ }
}
}
}

1
libraw.changes
View File

@ -5,6 +5,7 @@ Wed Sep 13 10:25:35 UTC 2017 - pgajdos@suse.com
* Fix for possible heap overrun in Canon makernotes parser * Fix for possible heap overrun in Canon makernotes parser
* Fix for CVE-2017-13735 * Fix for CVE-2017-13735
* CVE-2017-14265: Additional check for X-Trans CFA pattern data * CVE-2017-14265: Additional check for X-Trans CFA pattern data
- add libraw-CVE-2017-14348.patch [bsc#1058467]
- remove libraw-CVE-2017-6887,6886.patch and - remove libraw-CVE-2017-6887,6886.patch and
libraw-CVE-2017-6890,6899.patch: libraw-CVE-2017-6890,6899.patch:
no need to patch dcraw.c, it is not used no need to patch dcraw.c, it is not used

2
libraw.spec
View File

@ -30,6 +30,7 @@ Url: http://www.libraw.org/
#Git-Clone: git://github.com/LibRaw/LibRaw #Git-Clone: git://github.com/LibRaw/LibRaw
Source: http://www.libraw.org/data/%tar_name-%version.tar.gz Source: http://www.libraw.org/data/%tar_name-%version.tar.gz
Patch0: libraw-CVE-2017-14348.patch
BuildRequires: fdupes BuildRequires: fdupes
BuildRequires: gcc-c++ BuildRequires: gcc-c++
BuildRequires: libjasper-devel BuildRequires: libjasper-devel
@ -98,6 +99,7 @@ against LibRaw. LibRaw does not provide dynamic libraries.
%prep %prep
%setup -qn %tar_name-%version %setup -qn %tar_name-%version
%patch0 -p1
%build %build
export CXXFLAGS="%optflags -fPIC -DUSE_ZLIB" export CXXFLAGS="%optflags -fPIC -DUSE_ZLIB"