Pisilinux/main
5
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

darktable

Browse Source
This commit is contained in:
Rmys
2026-04-07 16:04:21 +03:00
parent 41b84d94dd
commit bbdb25cd80
3 changed files with 50 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
multimedia/graphics/darktable/files/cve-2026-5318.patch
+27
View File
@@ -0,0 +1,27 @@
diff -urNr darktable-5.4.1-orig/src/external/LibRaw/src/decompressors/losslessjpeg.cpp darktable-5.4.1/src/external/LibRaw/src/decompressors/losslessjpeg.cpp
--- darktable-5.4.1-orig/src/external/LibRaw/src/decompressors/losslessjpeg.cpp 2026-01-09 10:59:59.000000000 +0100
+++ darktable-5.4.1/src/external/LibRaw/src/decompressors/losslessjpeg.cpp 2026-04-02 23:23:27.630825281 +0200
@@ -361,6 +361,7 @@
nbits--;
}
hufftable.resize( size_t(1ULL << nbits));
+ uint32_t tsize = 1 << nbits;
for (unsigned i = 0; i < hufftable.size(); i++) hufftable[i] = 0;
int h = 0;
@@ -371,10 +372,14 @@
{
for (int j = 0; j < (1 << (nbits - len - 1)); j++)
{
- hufftable[h] = ((len+1) << 16) | (uint8_t(huffval[pos] & 0xff) << 8) | uint8_t(shiftval[pos] & 0xff);
+ if (h >= tsize)
+ throw LIBRAW_EXCEPTION_IO_CORRUPT;
+ hufftable[h] = ((len + 1) << 16) | (uint8_t(huffval[pos] & 0xff) << 8) | uint8_t(shiftval[pos] & 0xff);
h++;
}
pos++;
+ if(pos >= 256)
+ throw LIBRAW_EXCEPTION_IO_CORRUPT;
}
}
if (!disable_cache)