Rmys
28 lines
1.1 KiB
Diff
28 lines
1.1 KiB
Diff
diff -urNr darktable-5.4.1-orig/src/external/LibRaw/src/decompressors/losslessjpeg.cpp darktable-5.4.1/src/external/LibRaw/src/decompressors/losslessjpeg.cpp
|
|
--- darktable-5.4.1-orig/src/external/LibRaw/src/decompressors/losslessjpeg.cpp 2026-01-09 10:59:59.000000000 +0100
|
|
+++ darktable-5.4.1/src/external/LibRaw/src/decompressors/losslessjpeg.cpp 2026-04-02 23:23:27.630825281 +0200
|
|
@@ -361,6 +361,7 @@
|
|
nbits--;
|
|
}
|
|
hufftable.resize( size_t(1ULL << nbits));
|
|
+ uint32_t tsize = 1 << nbits;
|
|
for (unsigned i = 0; i < hufftable.size(); i++) hufftable[i] = 0;
|
|
|
|
int h = 0;
|
|
@@ -371,10 +372,14 @@
|
|
{
|
|
for (int j = 0; j < (1 << (nbits - len - 1)); j++)
|
|
{
|
|
- hufftable[h] = ((len+1) << 16) | (uint8_t(huffval[pos] & 0xff) << 8) | uint8_t(shiftval[pos] & 0xff);
|
|
+ if (h >= tsize)
|
|
+ throw LIBRAW_EXCEPTION_IO_CORRUPT;
|
|
+ hufftable[h] = ((len + 1) << 16) | (uint8_t(huffval[pos] & 0xff) << 8) | uint8_t(shiftval[pos] & 0xff);
|
|
h++;
|
|
}
|
|
pos++;
|
|
+ if(pos >= 256)
|
|
+ throw LIBRAW_EXCEPTION_IO_CORRUPT;
|
|
}
|
|
}
|
|
if (!disable_cache)
|