diff options
| author | Remi Collet <remi@remirepo.net> | 2019-08-13 09:14:04 +0200 |
|---|---|---|
| committer | Remi Collet <remi@remirepo.net> | 2019-08-13 09:14:04 +0200 |
| commit | b74dfd5479b12dd702294fbd3c6ad1a86a11f48a (patch) | |
| tree | 72aadb666f55ce824cbc214ac65d207214051c44 /libkdcraw-4.10.5-CVE-2013-2126.patch | |
import from 7.6
Diffstat (limited to 'libkdcraw-4.10.5-CVE-2013-2126.patch')
| -rw-r--r-- | libkdcraw-4.10.5-CVE-2013-2126.patch | 24 |
1 files changed, 24 insertions, 0 deletions
diff --git a/libkdcraw-4.10.5-CVE-2013-2126.patch b/libkdcraw-4.10.5-CVE-2013-2126.patch new file mode 100644 index 0000000..221da0a --- /dev/null +++ b/libkdcraw-4.10.5-CVE-2013-2126.patch @@ -0,0 +1,24 @@ +diff -up libkdcraw-4.10.5/libraw/src/libraw_cxx.cpp.CVE-2013-2126 libkdcraw-4.10.5/libraw/src/libraw_cxx.cpp +--- libkdcraw-4.10.5/libraw/src/libraw_cxx.cpp.CVE-2013-2126 2013-07-15 14:39:22.000000000 +0200 ++++ libkdcraw-4.10.5/libraw/src/libraw_cxx.cpp 2013-07-15 14:45:31.000000000 +0200 +@@ -1055,8 +1055,8 @@ int LibRaw::unpack(void) + S.iheight= S.height; + IO.shrink = 0; + // allocate image as temporary buffer, size +- imgdata.rawdata.raw_alloc = calloc(S.iwidth*S.iheight,sizeof(*imgdata.image)); +- imgdata.image = (ushort (*)[4]) imgdata.rawdata.raw_alloc; ++ imgdata.rawdata.raw_alloc = 0; ++ imgdata.image = (ushort (*)[4]) calloc(S.iwidth*S.iheight,sizeof(*imgdata.image)); + } + ID.input->seek(libraw_internal_data.unpacker_data.data_offset, SEEK_SET); + (this->*load_raw)(); +@@ -1073,8 +1073,8 @@ int LibRaw::unpack(void) + // recover saved + if( decoder_info.decoder_flags & LIBRAW_DECODER_LEGACY) + { ++ imgdata.rawdata.raw_alloc = imgdata.rawdata.color_image = imgdata.image; + imgdata.image = 0; +- imgdata.rawdata.color_image = (ushort (*)[4]) imgdata.rawdata.raw_alloc; + } + + // recover image sizes |