Bug#1142984: trixie-pu: package libraw/0.21.4-2+deb13u1
Guilhem Moulin <[email protected]> Wed, 29 Jul 2026 14:09:30 +0200
| Newsgroups | gmane.linux.debian.devel.release |
|---|---|
| Message-ID | <amntepnMV2aCF6Kp__26469.4435683609$1785327107$gmane$org@debian.org> |
--XrXWrAvNDSA1+1MR Content-Type: multipart/mixed; boundary="OAvz3+Rcct4kXK63" Content-Disposition: inline --OAvz3+Rcct4kXK63 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Package: release.debian.org Severity: normal Tags: trixie X-Debbugs-Cc: [email protected] Control: affects -1 + src:libraw User: [email protected] Usertags: pu [ Reason ] Fix <no-dsa> issues CVE-2026-5342, CVE-2026-20884, CVE-2026-20889, CVE-2026-21413, CVE-2026-24450 and CVE-2026-24660. [ Impact ] Users will remain vulnerable to the afformentioned issues, and will regress when upgrading upgrading (a fix was uploaded to Bookworm LTS and Bullseye LTS as part of DLA-4704-1). [ Tests ] Manual tests only using the reporter's PoC information. AFAICT neither the package nor the upstream code have an automated test suite. [ Risks ] Low risk, all changes have been backported from upstream's 0.22.1 version and trivially apply to trixie's 0.21.4 codebase. [ Checklist ] [x] *all* changes are documented in the d/changelog [x] I reviewed all changes and I approve them [x] attach debdiff against the package in stable [x] the issue is verified as fixed in unstable [ Changes ] * Fix CVE-2026-5342: nikon_load_padded_packed_raw() out-of-bounds read due to missing buffer and dimension validation (closes: #1132655). * Fix CVE-2026-20884: deflate_dng_load_raw() integer overflow vulnerabili= ty (closes: #1133845). * Fix CVE-2026-20889: x3f_thumb_loader() heap-based buffer overflow vulnerability (closes: #1133845). * Fix CVE-2026-21413: lossless_jpeg_load_raw() heap-based buffer overflow vulnerability (closes: #1133845). * Fix CVE-2026-24450: uncompressed_fp_dng_load_raw() integer overflow vulnerability (closes: #1133845). * Fix CVE-2026-24660: x3f_load_huffman() heap-based buffer overflow vulnerability (closes: #1133845). * Add d/salsa-ci.yml for Salsa CI. [ Other info ] Debusine workflow output: https://debusine.debian.net/debian/developers/work-request/940417/ Individual commits and tag can be found on the LTS team fork at https://salsa.debian.org/lts-team/packages/libraw/-/tree/debian/trixie?ref_= type=3Dheads --=20 Guilhem. --OAvz3+Rcct4kXK63 Content-Type: text/prs.lines.tag; charset=utf-8 Content-Disposition: attachment; filename=libraw.dsc Content-Transfer-Encoding: quoted-printable diffstat for libraw-0.21.4 libraw-0.21.4 changelog | 19 + patches/CVE-2026-20884/01-afba34ec3.patch | 69 ++++++ patches/CVE-2026-20884/02-dae685a19.patch | 36 +++ patches/CVE-2026-20884/03-aa4458eb5.patch | 61 +++++ patches/CVE-2026-20889.patch | 96 ++++++++ patches/CVE-2026-21413.patch | 33 ++ patches/CVE-2026-24450.patch | 55 ++++ patches/CVE-2026-24660.patch | 335 +++++++++++++++++++++++++= +++++ patches/CVE-2026-5342.patch | 61 +++++ patches/series | 8=20 salsa-ci.yml | 9=20 11 files changed, 782 insertions(+) diff -Nru libraw-0.21.4/debian/changelog libraw-0.21.4/debian/changelog --- libraw-0.21.4/debian/changelog 2025-04-24 15:52:02.000000000 +0200 +++ libraw-0.21.4/debian/changelog 2026-07-29 03:53:35.000000000 +0200 @@ -1,3 +1,22 @@ +libraw (0.21.4-2+deb13u1) trixie; urgency=3Dhigh + + * Non-maintainer upload. + * Fix CVE-2026-5342: nikon_load_padded_packed_raw() out-of-bounds read + due to missing buffer and dimension validation (closes: #1132655). + * Fix CVE-2026-20884: deflate_dng_load_raw() integer overflow vulnerabil= ity + (closes: #1133845). + * Fix CVE-2026-20889: x3f_thumb_loader() heap-based buffer overflow + vulnerability (closes: #1133845). + * Fix CVE-2026-21413: lossless_jpeg_load_raw() heap-based buffer overflow + vulnerability (closes: #1133845). + * Fix CVE-2026-24450: uncompressed_fp_dng_load_raw() integer overflow + vulnerability (closes: #1133845). + * Fix CVE-2026-24660: x3f_load_huffman() heap-based buffer overflow + vulnerability (closes: #1133845). + * Add d/salsa-ci.yml for Salsa CI. + + -- Guilhem Moulin <[email protected]> Wed, 29 Jul 2026 03:53:35 +0200 + libraw (0.21.4-2) unstable; urgency=3Dmedium =20 * Team upload. diff -Nru libraw-0.21.4/debian/patches/CVE-2026-20884/01-afba34ec3.patch li= braw-0.21.4/debian/patches/CVE-2026-20884/01-afba34ec3.patch --- libraw-0.21.4/debian/patches/CVE-2026-20884/01-afba34ec3.patch 1970-01-= 01 01:00:00.000000000 +0100 +++ libraw-0.21.4/debian/patches/CVE-2026-20884/01-afba34ec3.patch 2026-07-= 29 03:53:35.000000000 +0200 @@ -0,0 +1,69 @@ +From: Alex Tutubalin <[email protected]> +Date: Sun, 28 Dec 2025 19:18:36 +0300 +Subject: implemented RAW size limit check and allocation result check for + 4-shot pentax loaded and FP-dng loader + +Origin: https://github.com/LibRaw/LibRaw/commit/afba34ec30bf6409891dc096f6= be69155ecf6bdb +Bug: https://talosintelligence.com/vulnerability_reports/TALOS-2026-2364 +Bug-Debian: https://bugs.debian.org/1133845 +Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2026-= 20884 +--- + src/decoders/decoders_libraw.cpp | 12 ++++++++++-- + src/decoders/fp_dng.cpp | 9 ++++++++- + 2 files changed, 18 insertions(+), 3 deletions(-) + +diff --git a/src/decoders/decoders_libraw.cpp b/src/decoders/decoders_libr= aw.cpp +index 952e41a..eb277c3 100644 +--- a/src/decoders/decoders_libraw.cpp ++++ b/src/decoders/decoders_libraw.cpp +@@ -54,6 +54,10 @@ void LibRaw::sony_arq_load_raw() +=20 + void LibRaw::pentax_4shot_load_raw() + { ++ size_t alloc_sz =3D size_t(imgdata.sizes.raw_width) * (size_t(imgdata.s= izes.raw_height) + 16) * 4 * sizeof(ushort); ++ if (INT64(alloc_sz) > INT64(imgdata.rawparams.max_raw_memory_mb) * INT6= 4(1024 * 1024)) ++ throw LIBRAW_EXCEPTION_TOOBIG; ++ + #ifdef LIBRAW_CALLOC_RAWSTORE + ushort *plane =3D (ushort *)calloc(size_t(imgdata.sizes.raw_width) * + size_t(imgdata.sizes.raw_height), size= of(ushort)); +@@ -61,13 +65,17 @@ void LibRaw::pentax_4shot_load_raw() + ushort *plane =3D (ushort *)malloc(size_t(imgdata.sizes.raw_width) * + size_t(imgdata.sizes.raw_height) * siz= eof(ushort)); + #endif +- int alloc_sz =3D imgdata.sizes.raw_width * (imgdata.sizes.raw_height + = 16) * 4 * +- sizeof(ushort); ++ if (!plane) ++ throw LIBRAW_EXCEPTION_ALLOC; ++ + #ifdef LIBRAW_CALLOC_RAWSTORE + ushort(*result)[4] =3D (ushort(*)[4])calloc(alloc_sz,1); + #else + ushort(*result)[4] =3D (ushort(*)[4])malloc(alloc_sz); + #endif ++ if(!result) ++ throw LIBRAW_EXCEPTION_ALLOC; ++ + struct movement_t + { + int row, col; +diff --git a/src/decoders/fp_dng.cpp b/src/decoders/fp_dng.cpp +index 4bb8f42..6f82e89 100644 +--- a/src/decoders/fp_dng.cpp ++++ b/src/decoders/fp_dng.cpp +@@ -350,7 +350,14 @@ void LibRaw::deflate_dng_load_raw() + libraw_internal_data.internal_data.input); +=20 + if (ifd->sample_format =3D=3D 3) +- float_raw_image =3D (float *)calloc(tiles.tileCnt * tiles.tileWidth= * tiles.tileHeight *ifd->samples, sizeof(float)); ++ { ++ INT64 raw_bytes =3D tiles.tileCnt * tiles.tileWidth * tiles.tileHeigh= t * ifd->samples * sizeof(float); ++ if (raw_bytes > INT64(imgdata.rawparams.max_raw_memory_mb) * INT64(10= 24 * 1024)) ++ throw LIBRAW_EXCEPTION_TOOBIG; ++ float_raw_image =3D (float *)calloc(tiles.tileCnt * tiles.tileWidth *= tiles.tileHeight * ifd->samples, sizeof(float)); ++ if (!float_raw_image) ++ throw LIBRAW_EXCEPTION_ALLOC; ++ } + else + throw LIBRAW_EXCEPTION_DECODE_RAW; // Only float deflated supported +=20 diff -Nru libraw-0.21.4/debian/patches/CVE-2026-20884/02-dae685a19.patch li= braw-0.21.4/debian/patches/CVE-2026-20884/02-dae685a19.patch --- libraw-0.21.4/debian/patches/CVE-2026-20884/02-dae685a19.patch 1970-01-= 01 01:00:00.000000000 +0100 +++ libraw-0.21.4/debian/patches/CVE-2026-20884/02-dae685a19.patch 2026-07-= 29 03:53:35.000000000 +0200 @@ -0,0 +1,36 @@ +From: Alex Tutubalin <[email protected]> +Date: Sat, 7 Mar 2026 18:40:05 +0300 +Subject: FP DNG data limit: perform calculations in 64 bit + +Origin: https://github.com/LibRaw/LibRaw/commit/dae685a198309b978805f098ba= fe5d951dbc8747 +Bug: https://talosintelligence.com/vulnerability_reports/TALOS-2026-2364 +Bug-Debian: https://bugs.debian.org/1133845 +Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2026-= 20884 +--- + src/decoders/fp_dng.cpp | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +diff --git a/src/decoders/fp_dng.cpp b/src/decoders/fp_dng.cpp +index 6f82e89..b18ca33 100644 +--- a/src/decoders/fp_dng.cpp ++++ b/src/decoders/fp_dng.cpp +@@ -376,12 +376,15 @@ void LibRaw::deflate_dng_load_raw() + break; + } +=20 +- unsigned tilePixels =3D tiles.tileWidth * tiles.tileHeight; ++ INT64 tilePixels =3D INT64(tiles.tileWidth) * INT64(tiles.tileHeight); + unsigned pixelSize =3D sizeof(float) * ifd->samples; +- unsigned tileBytes =3D tilePixels * pixelSize; +- unsigned tileRowBytes =3D tiles.tileWidth * pixelSize; ++ INT64 tileBytes =3D tilePixels * INT64(pixelSize); ++ INT64 tileRowBytes =3D INT64(tiles.tileWidth) * INT64(pixelSize); +=20 +- if(INT64(tiles.maxBytesInTile) > INT64(imgdata.rawparams.max_raw_memory= _mb) * INT64(1024 * 1024) ) ++ if(INT64(tiles.maxBytesInTile) > INT64(imgdata.rawparams.max_raw_memory= _mb) * 1024LL * 1024LL ) ++ throw LIBRAW_EXCEPTION_TOOBIG; ++ ++ if (tileBytes + tileRowBytes > INT64(imgdata.rawparams.max_raw_memory_m= b) * 1024LL * 1024LL) + throw LIBRAW_EXCEPTION_TOOBIG; +=20 + std::vector<uchar> cBuffer(tiles.maxBytesInTile,0); diff -Nru libraw-0.21.4/debian/patches/CVE-2026-20884/03-aa4458eb5.patch li= braw-0.21.4/debian/patches/CVE-2026-20884/03-aa4458eb5.patch --- libraw-0.21.4/debian/patches/CVE-2026-20884/03-aa4458eb5.patch 1970-01-= 01 01:00:00.000000000 +0100 +++ libraw-0.21.4/debian/patches/CVE-2026-20884/03-aa4458eb5.patch 2026-07-= 29 03:53:35.000000000 +0200 @@ -0,0 +1,61 @@ +From: Alex Tutubalin <[email protected]> +Date: Fri, 13 Mar 2026 17:43:47 +0300 +Subject: Fix for data size calculation integer overflow in float/deflated = DNG + loader (TALOS-2026-2364); Check for read results + +Origin: https://github.com/LibRaw/LibRaw/commit/aa4458eb511daeae90676c1ce5= c587106e4aaec1 +Bug: https://talosintelligence.com/vulnerability_reports/TALOS-2026-2364 +Bug-Debian: https://bugs.debian.org/1133845 +Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2026-= 20884 +--- + src/decoders/fp_dng.cpp | 26 +++++++++++++++++++++----- + 1 file changed, 21 insertions(+), 5 deletions(-) + +diff --git a/src/decoders/fp_dng.cpp b/src/decoders/fp_dng.cpp +index b18ca33..c460373 100644 +--- a/src/decoders/fp_dng.cpp ++++ b/src/decoders/fp_dng.cpp +@@ -349,14 +349,28 @@ void LibRaw::deflate_dng_load_raw() + tiles.init(ifd, imgdata.sizes, libraw_internal_data.unpacker_data, libr= aw_internal_data.unpacker_data.order, + libraw_internal_data.internal_data.input); +=20 ++ if (tiles.tBytes.size() < 1) ++ throw LIBRAW_EXCEPTION_IO_CORRUPT; ++ ++ // Ensure less then 2GB per compressed tile ++ INT64 maxcomprlen =3D tiles.tBytes[0]; ++ for (int i =3D 1; i < tiles.tBytes.size(); i++) ++ maxcomprlen =3D MAX(maxcomprlen, tiles.tBytes[i]); ++ ++ if(maxcomprlen >=3D (1LL << 31) || maxcomprlen < 0) ++ throw LIBRAW_EXCEPTION_TOOBIG; ++ =20 ++ // Max bytes: 2^16 raw width * 2^2 bytes/pixel * 2^2 channels =3D 2^20,= so check against 2^22 ++ INT64 rowbytes =3D INT64(MAX(tiles.tileWidth, imgdata.sizes.raw_width))= * 4ULL * INT64(ifd->samples); ++ if (rowbytes > (1LL << 22)) ++ throw LIBRAW_EXCEPTION_TOOBIG; ++ + if (ifd->sample_format =3D=3D 3) + { +- INT64 raw_bytes =3D tiles.tileCnt * tiles.tileWidth * tiles.tileHeigh= t * ifd->samples * sizeof(float); ++ INT64 raw_bytes =3D INT64(tiles.tileCnt) * INT64(tiles.tileWidth) * I= NT64(tiles.tileHeight) * INT64(ifd->samples) * sizeof(float); + if (raw_bytes > INT64(imgdata.rawparams.max_raw_memory_mb) * INT64(10= 24 * 1024)) + throw LIBRAW_EXCEPTION_TOOBIG; +- float_raw_image =3D (float *)calloc(tiles.tileCnt * tiles.tileWidth *= tiles.tileHeight * ifd->samples, sizeof(float)); +- if (!float_raw_image) +- throw LIBRAW_EXCEPTION_ALLOC; ++ float_raw_image =3D (float *)calloc(raw_bytes, 1); + } + else + throw LIBRAW_EXCEPTION_DECODE_RAW; // Only float deflated supported +@@ -395,7 +409,9 @@ void LibRaw::deflate_dng_load_raw() + for (size_t x =3D 0; x < imgdata.sizes.raw_width; x +=3D tiles.tile= Width, ++t) + { + libraw_internal_data.internal_data.input->seek(tiles.tOffsets[t],= SEEK_SET); +- libraw_internal_data.internal_data.input->read(cBuffer.data(), 1,= tiles.tBytes[t]); ++ int bytesread =3D libraw_internal_data.internal_data.input->read(= cBuffer.data(), 1, tiles.tBytes[t]); ++ if (bytesread < tiles.tBytes[t]) ++ derror(); + unsigned long dstLen =3D tileBytes; + int err =3D + uncompress(uBuffer.data() + tileRowBytes, &dstLen, cBuffer.da= ta(), (unsigned long)tiles.tBytes[t]); diff -Nru libraw-0.21.4/debian/patches/CVE-2026-20889.patch libraw-0.21.4/d= ebian/patches/CVE-2026-20889.patch --- libraw-0.21.4/debian/patches/CVE-2026-20889.patch 1970-01-01 01:00:00.0= 00000000 +0100 +++ libraw-0.21.4/debian/patches/CVE-2026-20889.patch 2026-07-29 03:53:35.0= 00000000 +0200 @@ -0,0 +1,96 @@ +From: Alex Tutubalin <[email protected]> +Date: Sun, 1 Mar 2026 19:54:16 +0300 +Subject: Fix for TALOS-2026-2358 + +Origin: https://github.com/LibRaw/LibRaw/commit/b9809e410d07ca7bf408e6d036= 615fb34f8c47cc +Bug: https://talosintelligence.com/vulnerability_reports/TALOS-2026-2358 +Bug-Debian: https://bugs.debian.org/1133845 +Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2026-= 20889 +--- + src/decoders/unpack_thumb.cpp | 2 ++ + src/x3f/x3f_parse_process.cpp | 20 ++++++++++++++++++-- + src/x3f/x3f_utils_patched.cpp | 7 +++++++ + 3 files changed, 27 insertions(+), 2 deletions(-) + +diff --git a/src/decoders/unpack_thumb.cpp b/src/decoders/unpack_thumb.cpp +index df30da1..f79b0bb 100644 +--- a/src/decoders/unpack_thumb.cpp ++++ b/src/decoders/unpack_thumb.cpp +@@ -387,6 +387,8 @@ int LibRaw::unpack_thumb(void) + {=0D + x3f_thumb_loader();=0D + SET_PROC_FLAG(LIBRAW_PROGRESS_THUMB_LOAD);=0D ++ if (!T.twidth && !T.theight)=0D ++ return LIBRAW_NO_THUMBNAIL;=0D + return 0;=0D + }=0D + #endif=0D +diff --git a/src/x3f/x3f_parse_process.cpp b/src/x3f/x3f_parse_process.cpp +index 354e467..9742c8e 100644 +--- a/src/x3f/x3f_parse_process.cpp ++++ b/src/x3f/x3f_parse_process.cpp +@@ -322,6 +322,7 @@ void LibRaw::x3f_thumb_loader() + { + try + { ++ INT64 checked_size =3D x3f_thumb_size(); // This value was checked at= upper level? + x3f_t *x3f =3D (x3f_t *)_x3f_data; + if (!x3f) + return; // No data pointer set +@@ -339,12 +340,24 @@ void LibRaw::x3f_thumb_loader() + imgdata.thumbnail.tcolors =3D 3; + if (imgdata.thumbnail.tformat =3D=3D LIBRAW_THUMBNAIL_JPEG) + { +- imgdata.thumbnail.thumb =3D (char *)malloc(ID->data_size); ++ INT64 alloc_size =3D ID->data_size; ++ if ((alloc_size > 2 * checked_size) || (alloc_size > 1024LL * 1024LL *= LIBRAW_MAX_THUMBNAIL_MB)) ++ throw LIBRAW_EXCEPTION_TOOBIG; ++ if(alloc_size < 64LL) ++ throw LIBRAW_EXCEPTION_IO_CORRUPT; ++ ++ imgdata.thumbnail.thumb =3D (char *)malloc(ID->data_size); + memmove(imgdata.thumbnail.thumb, ID->data, ID->data_size); + imgdata.thumbnail.tlength =3D ID->data_size; + } + else if (imgdata.thumbnail.tformat =3D=3D LIBRAW_THUMBNAIL_BITMAP) + { ++ INT64 alloc_size =3D INT64(ID->columns) * INT64(ID->rows) * 3LL; ++ if ((alloc_size > 2 * checked_size) || ++ (alloc_size > 1024LL * 1024LL * LIBRAW_MAX_THUMBNAIL_MB)) throw= LIBRAW_EXCEPTION_TOOBIG; ++ if (alloc_size < 64LL) ++ throw LIBRAW_EXCEPTION_IO_CORRUPT; ++ + imgdata.thumbnail.tlength =3D ID->columns * ID->rows * 3; + imgdata.thumbnail.thumb =3D (char *)malloc(ID->columns * ID->rows *= 3); + char *src0 =3D (char *)ID->data; +@@ -361,7 +374,10 @@ void LibRaw::x3f_thumb_loader() + } + catch (...) + { +- // do nothing ++ // no rethrow: handled at upper level ++ imgdata.thumbnail.twidth =3D 0; ++ imgdata.thumbnail.theight =3D 0; ++ imgdata.thumbnail.tcolors =3D 0; + } + } +=20 +diff --git a/src/x3f/x3f_utils_patched.cpp b/src/x3f/x3f_utils_patched.cpp +index 6b20b90..21c7ab1 100644 +--- a/src/x3f/x3f_utils_patched.cpp ++++ b/src/x3f/x3f_utils_patched.cpp +@@ -1221,7 +1221,14 @@ static uint32_t read_data_block(void **data, x3f_in= fo_t *I, + if (fpos + size > I->input.file->size()) + throw LIBRAW_EXCEPTION_IO_CORRUPT; +=20 ++ // All known files from real cameras are many times smaller than 1 GB, = so the hard limit is OK here. ++ ++ if(size > 1024*1024*1024) ++ throw LIBRAW_EXCEPTION_ALLOC; ++ + *data =3D (void *)malloc(size); ++ if (!*data) ++ throw LIBRAW_EXCEPTION_ALLOC; +=20 + GETN(*data, size); +=20 diff -Nru libraw-0.21.4/debian/patches/CVE-2026-21413.patch libraw-0.21.4/d= ebian/patches/CVE-2026-21413.patch --- libraw-0.21.4/debian/patches/CVE-2026-21413.patch 1970-01-01 01:00:00.0= 00000000 +0100 +++ libraw-0.21.4/debian/patches/CVE-2026-21413.patch 2026-07-29 03:53:35.0= 00000000 +0200 @@ -0,0 +1,33 @@ +From: Alex Tutubalin <[email protected]> +Date: Sat, 28 Feb 2026 18:26:53 +0300 +Subject: Fix for TALOS-2026-2331 + +Origin: https://github.com/LibRaw/LibRaw/commit/75ed2c12a35b765b3b6ad695cc= 1f044f19efe644 +Bug: https://talosintelligence.com/vulnerability_reports/TALOS-2026-2331 +Bug-Debian: https://bugs.debian.org/1133845 +Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2026-= 21413 +--- + src/decoders/decoders_dcraw.cpp | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/src/decoders/decoders_dcraw.cpp b/src/decoders/decoders_dcraw= =2Ecpp +index 183136b..fc73e6c 100644 +--- a/src/decoders/decoders_dcraw.cpp ++++ b/src/decoders/decoders_dcraw.cpp +@@ -560,6 +560,7 @@ void LibRaw::lossless_jpeg_load_raw() + if (jh.clrs =3D=3D 4 && jwide >=3D raw_width * 2) + jhigh *=3D 2; +=20 ++ =20 + try + { + for (jrow =3D 0; jrow < jh.high; jrow++) +@@ -588,7 +589,7 @@ void LibRaw::lossless_jpeg_load_raw() + col +=3D (row--, raw_width); + if (row > raw_height) + throw LIBRAW_EXCEPTION_IO_CORRUPT; +- if ((unsigned)row < raw_height) ++ if (((unsigned)row < raw_height) && ((unsigned)col < raw_width)) + RAW(row, col) =3D val; + if (++col >=3D raw_width) + col =3D (row++, 0); diff -Nru libraw-0.21.4/debian/patches/CVE-2026-24450.patch libraw-0.21.4/d= ebian/patches/CVE-2026-24450.patch --- libraw-0.21.4/debian/patches/CVE-2026-24450.patch 1970-01-01 01:00:00.0= 00000000 +0100 +++ libraw-0.21.4/debian/patches/CVE-2026-24450.patch 2026-07-29 03:53:35.0= 00000000 +0200 @@ -0,0 +1,55 @@ +From: Alex Tutubalin <[email protected]> +Date: Thu, 12 Mar 2026 20:34:53 +0300 +Subject: Fix for TALOS-2026-2363: avoid integer overflow in allocation size + calculation. Also: check for EOF in read loop + +Origin: https://github.com/LibRaw/LibRaw/commit/c911c9b9edffa5fab99f828d0f= ee6dd2d0f6105f +Bug: https://talosintelligence.com/vulnerability_reports/TALOS-2026-2363 +Bug-Debian: https://bugs.debian.org/1133845 +Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2026-= 24450 +--- + src/decoders/fp_dng.cpp | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/src/decoders/fp_dng.cpp b/src/decoders/fp_dng.cpp +index df7fe6c..4bb8f42 100644 +--- a/src/decoders/fp_dng.cpp ++++ b/src/decoders/fp_dng.cpp +@@ -611,12 +611,17 @@ void LibRaw::uncompressed_fp_dng_load_raw() + tiles.init(ifd, imgdata.sizes, libraw_internal_data.unpacker_data, li= braw_internal_data.unpacker_data.order, + libraw_internal_data.internal_data.input); +=20 ++ // Max bytes: 2^16 raw width * 2^2 bytes/pixel * 2^2 channels =3D 2^20, = so check against 2^22 ++ INT64 rowbytes =3D INT64(MAX(tiles.tileWidth, imgdata.sizes.raw_width)) = * INT64(MAX(bytesps,4)) * INT64(ifd->samples); ++ if(rowbytes > (1LL << 22)) ++ throw LIBRAW_EXCEPTION_TOOBIG; ++ + INT64 allocsz =3D INT64(tiles.tileCnt) * INT64(tiles.tileWidth) * INT64(= tiles.tileHeight) * INT64(ifd->samples) * INT64(sizeof(float)); + if (allocsz > INT64(imgdata.rawparams.max_raw_memory_mb) * INT64(1024 * = 1024)) + throw LIBRAW_EXCEPTION_TOOBIG; +=20 + if (ifd->sample_format =3D=3D 3) +- float_raw_image =3D (float *)calloc(tiles.tileCnt * tiles.tileWid= th * tiles.tileHeight *ifd->samples, sizeof(float)); ++ float_raw_image =3D (float *)calloc(allocsz,1); + else + throw LIBRAW_EXCEPTION_DECODE_RAW; // Only float supported +=20 +@@ -633,6 +638,7 @@ void LibRaw::uncompressed_fp_dng_load_raw() + size_t rowsInTile =3D y + tiles.tileHeight > imgdata.sizes.ra= w_height ? imgdata.sizes.raw_height - y : tiles.tileHeight; + size_t colsInTile =3D x + tiles.tileWidth > imgdata.sizes.raw= _width ? imgdata.sizes.raw_width - x : tiles.tileWidth; +=20 ++ // inrowbytes is less then 2^22 (see above) so conversion to int is sa= fe + size_t inrowbytes =3D colsInTile * bytesps * ifd->samples; + int fullrowbytes =3D tiles.tileWidth *bytesps * ifd->samples; + size_t outrowbytes =3D colsInTile * sizeof(float) * ifd->samp= les; +@@ -642,7 +648,9 @@ void LibRaw::uncompressed_fp_dng_load_raw() + unsigned char *dst =3D fullrowbytes > inrowbytes ? rowbuf= =2Edata(): // last tile in row, use buffer + (unsigned char *)&float_raw_image + [((y + row) * imgdata.sizes.raw_width + x) * ifd->sam= ples]; +- libraw_internal_data.internal_data.input->read(dst, 1, fu= llrowbytes); ++ int bytesread =3D libraw_internal_data.internal_data.inpu= t->read(dst, 1, fullrowbytes); ++ if (bytesread < fullrowbytes) ++ derror(); + if (bytesps =3D=3D 2 && difford) + libraw_swab(dst, fullrowbytes); + else if (bytesps =3D=3D 3 && (libraw_internal_data.unpack= er_data.order =3D=3D 0x4949)) // II-16bit diff -Nru libraw-0.21.4/debian/patches/CVE-2026-24660.patch libraw-0.21.4/d= ebian/patches/CVE-2026-24660.patch --- libraw-0.21.4/debian/patches/CVE-2026-24660.patch 1970-01-01 01:00:00.0= 00000000 +0100 +++ libraw-0.21.4/debian/patches/CVE-2026-24660.patch 2026-07-29 03:53:35.0= 00000000 +0200 @@ -0,0 +1,335 @@ +From: Alex Tutubalin <[email protected]> +Date: Wed, 11 Mar 2026 11:57:24 +0300 +Subject: X3F decoder: implemented hard single allocation limit via + LIBRAW_X3F_ALLOC_LIMIT_MB define; + allocation size calculation converted to 64 bit arithm; + fix for TALOS-2026-2359 + +Origin: https://github.com/LibRaw/LibRaw/commit/ac151a829b8d3e4c74fa3aefa8= a029c3cc3f857f +Bug: https://talosintelligence.com/vulnerability_reports/TALOS-2026-2359 +Bug-Debian: https://bugs.debian.org/1133845 +Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2026-= 24660 +--- + libraw/libraw_const.h | 4 ++ + src/x3f/x3f_utils_patched.cpp | 104 +++++++++++++++++++++++++------------= ----- + 2 files changed, 67 insertions(+), 41 deletions(-) + +diff --git a/libraw/libraw_const.h b/libraw/libraw_const.h +index 61f8028..1e32fdf 100644 +--- a/libraw/libraw_const.h ++++ b/libraw/libraw_const.h +@@ -55,6 +55,10 @@ it under the terms of the one of two licenses as you ch= oose: + #endif +=20 +=20 ++/* max data size for known foveon cameras: 30mpix * 3 channels * 2 bytes = =3D 180Mb, so 512Mb is OK for everything until/if new cameras will arrive */ ++#ifndef LIBRAW_X3F_ALLOC_LIMIT_MB ++#define LIBRAW_X3F_ALLOC_LIMIT_MB 512ULL ++#endif +=20 + /* LibRaw uses own memory pool management, with LIBRAW_MSIZE (512) + entries. It is enough for parsing/decoding non-damaged files, but +diff --git a/src/x3f/x3f_utils_patched.cpp b/src/x3f/x3f_utils_patched.cpp +index 21c7ab1..fb1ecc1 100644 +--- a/src/x3f/x3f_utils_patched.cpp ++++ b/src/x3f/x3f_utils_patched.cpp +@@ -50,6 +50,37 @@ BSD-style License + /* Reading and writing - assuming little endian in the file = */ + /* --------------------------------------------------------------------- = */ +=20 ++static void *x3f_limited_malloc(UINT64 sz) ++{ ++ if (sz > LIBRAW_X3F_ALLOC_LIMIT_MB * 1024ULL * 1024ULL) ++ throw LIBRAW_EXCEPTION_TOOBIG; ++ void *ret =3D malloc(sz); ++ if (!ret) ++ throw LIBRAW_EXCEPTION_ALLOC; ++ return ret; ++} ++ ++static void *x3f_limited_calloc(UINT64 n, UINT64 sz) ++{ ++ if (sz * n > LIBRAW_X3F_ALLOC_LIMIT_MB * 1024ULL * 1024ULL) ++ throw LIBRAW_EXCEPTION_TOOBIG; ++ void *ret =3D calloc(n, sz); ++ if (!ret) ++ throw LIBRAW_EXCEPTION_ALLOC; ++ return ret; ++} ++ ++static void *x3f_limited_realloc(void *ptr, UINT64 sz) ++{ ++ if (sz > LIBRAW_X3F_ALLOC_LIMIT_MB * 1024ULL * 1024ULL) ++ throw LIBRAW_EXCEPTION_TOOBIG; ++ void *ret =3D realloc(ptr, sz); ++ if (!ret) ++ throw LIBRAW_EXCEPTION_ALLOC; ++ return ret; ++} ++ ++ + static int x3f_get1(LibRaw_abstract_datastream *f) + { + /* Little endian file */ +@@ -134,7 +165,7 @@ unsigned x3f_get4(LibRaw_abstract_datastream *f) + int _i; = \ + (_T).size =3D (_NUM); = \ + (_T).element =3D = \ +- (_TYPE *)realloc((_T).element, (_NUM) * sizeof((_T).element[0]));= \ ++ (_TYPE *)x3f_limited_realloc((_T).element, (_NUM) * sizeof((_T).e= lement[0])); \ + for (_i =3D 0; _i < (int)(_T).size; _i++) = \ + _GETX((_T).element[_i]); = \ + } while (0) +@@ -144,7 +175,7 @@ unsigned x3f_get4(LibRaw_abstract_datastream *f) + { = \ + int _i; = \ + (_T).size =3D (_NUM); = \ +- (_T).element =3D (x3f_property_t *)realloc( = \ ++ (_T).element =3D (x3f_property_t *)x3f_limited_realloc( = \ + (_T).element, (_NUM) * sizeof((_T).element[0])); = \ + for (_i =3D 0; _i < (int)(_T).size; _i++) = \ + { = \ +@@ -161,7 +192,7 @@ unsigned x3f_get4(LibRaw_abstract_datastream *f) + for (_i =3D 0;; _i++) = \ + { = \ + (_T).size =3D _i + 1; = \ +- (_T).element =3D (x3f_true_huffman_element_t *)realloc( = \ ++ (_T).element =3D (x3f_true_huffman_element_t *)x3f_limited_realloc(= \ + (_T).element, (_i + 1) * sizeof((_T).element[0])); = \ + GET1((_T).element[_i].code_size); = \ + GET1((_T).element[_i].code); = \ +@@ -182,7 +213,7 @@ static void new_huffman_tree(x3f_hufftree_t *HTP, int = bits) +=20 + HTP->free_node_index =3D 0; + HTP->total_node_index =3D HUF_TREE_MAX_NODES(leaves); +- HTP->nodes =3D (x3f_huffnode_t *)calloc(1, HUF_TREE_MAX_NODES(leaves) * ++ HTP->nodes =3D (x3f_huffnode_t *)x3f_limited_calloc(1, HUF_TREE_MAX_NOD= ES(leaves) * + sizeof(x3f_huffnode_t)); + } +=20 +@@ -209,7 +240,7 @@ static void cleanup_true(x3f_true_t **TRUP) +=20 + static x3f_true_t *new_true(x3f_true_t **TRUP) + { +- x3f_true_t *TRU =3D (x3f_true_t *)calloc(1, sizeof(x3f_true_t)); ++ x3f_true_t *TRU =3D (x3f_true_t *)x3f_limited_calloc(1, sizeof(x3f_true= _t)); +=20 + cleanup_true(TRUP); +=20 +@@ -241,7 +272,7 @@ static void cleanup_quattro(x3f_quattro_t **QP) +=20 + static x3f_quattro_t *new_quattro(x3f_quattro_t **QP) + { +- x3f_quattro_t *Q =3D (x3f_quattro_t *)calloc(1, sizeof(x3f_quattro_t)); ++ x3f_quattro_t *Q =3D (x3f_quattro_t *)x3f_limited_calloc(1, sizeof(x3f_= quattro_t)); + int i; +=20 + cleanup_quattro(QP); +@@ -286,7 +317,7 @@ static void cleanup_huffman(x3f_huffman_t **HUFP) +=20 + static x3f_huffman_t *new_huffman(x3f_huffman_t **HUFP) + { +- x3f_huffman_t *HUF =3D (x3f_huffman_t *)calloc(1, sizeof(x3f_huffman_t)= ); ++ x3f_huffman_t *HUF =3D (x3f_huffman_t *)x3f_limited_calloc(1, sizeof(x3= f_huffman_t)); +=20 + cleanup_huffman(HUFP); +=20 +@@ -317,9 +348,7 @@ static x3f_huffman_t *new_huffman(x3f_huffman_t **HUFP) + if (!infile) + return NULL; + INT64 fsize =3D infile->size(); +- x3f_t *x3f =3D (x3f_t *)calloc(1, sizeof(x3f_t)); +- if (!x3f) +- throw LIBRAW_EXCEPTION_ALLOC; ++ x3f_t *x3f =3D (x3f_t *)x3f_limited_calloc(1, sizeof(x3f_t)); + try + { + x3f_info_t *I =3D NULL; +@@ -383,7 +412,7 @@ static x3f_huffman_t *new_huffman(x3f_huffman_t **HUFP) + if (DS->num_directory_entries > 0) + { + size_t size =3D DS->num_directory_entries * sizeof(x3f_directory_en= try_t); +- DS->directory_entry =3D (x3f_directory_entry_t *)calloc(1, size); ++ DS->directory_entry =3D (x3f_directory_entry_t *)x3f_limited_calloc= (1, size); + } +=20 + /* Traverse the directory */ +@@ -1220,15 +1249,8 @@ static uint32_t read_data_block(void **data, x3f_in= fo_t *I, +=20 + if (fpos + size > I->input.file->size()) + throw LIBRAW_EXCEPTION_IO_CORRUPT; +- +- // All known files from real cameras are many times smaller than 1 GB, = so the hard limit is OK here. +- +- if(size > 1024*1024*1024) +- throw LIBRAW_EXCEPTION_ALLOC; +- +- *data =3D (void *)malloc(size); +- if (!*data) +- throw LIBRAW_EXCEPTION_ALLOC; ++=20 ++ *data =3D (void *)x3f_limited_malloc(size); +=20 + GETN(*data, size); +=20 +@@ -1363,36 +1385,36 @@ static void x3f_load_true(x3f_info_t *I, x3f_direc= tory_entry_t *DE) + uint32_t columns =3D Q->plane[0].columns; + uint32_t rows =3D Q->plane[0].rows; + uint32_t channels =3D 3; +- uint32_t size =3D columns * rows * channels; ++ UINT64 size =3D UINT64(columns) * UINT64(rows) * UINT64(channels); +=20 + TRU->x3rgb16.columns =3D columns; + TRU->x3rgb16.rows =3D rows; + TRU->x3rgb16.channels =3D channels; + TRU->x3rgb16.row_stride =3D columns * channels; +- TRU->x3rgb16.buf =3D malloc(sizeof(uint16_t) * size); ++ TRU->x3rgb16.buf =3D x3f_limited_malloc(sizeof(uint16_t) * size); + TRU->x3rgb16.data =3D (uint16_t *)TRU->x3rgb16.buf; +=20 + columns =3D Q->plane[2].columns; + rows =3D Q->plane[2].rows; + channels =3D 1; +- size =3D columns * rows * channels; ++ size =3D UINT64(columns) * UINT64(rows) * UINT64(channels); +=20 + Q->top16.columns =3D columns; + Q->top16.rows =3D rows; + Q->top16.channels =3D channels; + Q->top16.row_stride =3D columns * channels; +- Q->top16.buf =3D malloc(sizeof(uint16_t) * size); ++ Q->top16.buf =3D x3f_limited_malloc(sizeof(uint16_t) * size); + Q->top16.data =3D (uint16_t *)Q->top16.buf; + } + else + { +- uint32_t size =3D ID->columns * ID->rows * 3; ++ UINT64 size =3D UINT64(ID->columns) * UINT64(ID->rows) * 3ULL; +=20 + TRU->x3rgb16.columns =3D ID->columns; + TRU->x3rgb16.rows =3D ID->rows; + TRU->x3rgb16.channels =3D 3; + TRU->x3rgb16.row_stride =3D ID->columns * 3; +- TRU->x3rgb16.buf =3D malloc(sizeof(uint16_t) * size); ++ TRU->x3rgb16.buf =3D x3f_limited_malloc(sizeof(uint16_t) * size); + TRU->x3rgb16.data =3D (uint16_t *)TRU->x3rgb16.buf; + } +=20 +@@ -1441,7 +1463,7 @@ static void x3f_load_huffman(x3f_info_t *I, x3f_dire= ctory_entry_t *DE, int bits, + x3f_directory_entry_header_t *DEH =3D &DE->header; + x3f_image_data_t *ID =3D &DEH->data_subsection.image_data; + x3f_huffman_t *HUF =3D new_huffman(&ID->huffman); +- uint32_t size; ++ UINT64 size; +=20 + if (use_map_table) + { +@@ -1454,21 +1476,21 @@ static void x3f_load_huffman(x3f_info_t *I, x3f_di= rectory_entry_t *DE, int bits, + { + case X3F_IMAGE_RAW_HUFFMAN_X530: + case X3F_IMAGE_RAW_HUFFMAN_10BIT: +- size =3D ID->columns * ID->rows * 3; ++ size =3D UINT64(ID->columns) * UINT64(ID->rows) * 3ULL; + HUF->x3rgb16.columns =3D ID->columns; + HUF->x3rgb16.rows =3D ID->rows; + HUF->x3rgb16.channels =3D 3; + HUF->x3rgb16.row_stride =3D ID->columns * 3; +- HUF->x3rgb16.buf =3D malloc(sizeof(uint16_t) * size); ++ HUF->x3rgb16.buf =3D x3f_limited_malloc(sizeof(uint16_t) * size); + HUF->x3rgb16.data =3D (uint16_t *)HUF->x3rgb16.buf; + break; + case X3F_IMAGE_THUMB_HUFFMAN: +- size =3D ID->columns * ID->rows * 3; ++ size =3D UINT64(ID->columns) * UINT64(ID->rows) * 3ULL; + HUF->rgb8.columns =3D ID->columns; + HUF->rgb8.rows =3D ID->rows; + HUF->rgb8.channels =3D 3; + HUF->rgb8.row_stride =3D ID->columns * 3; +- HUF->rgb8.buf =3D malloc(sizeof(uint8_t) * size); ++ HUF->rgb8.buf =3D x3f_limited_malloc(sizeof(uint8_t) * size); + HUF->rgb8.data =3D (uint8_t *)HUF->rgb8.buf; + break; + default: +@@ -1568,7 +1590,7 @@ static void x3f_load_camf_decode_type2(x3f_camf_t *C= AMF) + int i; +=20 + CAMF->decoded_data_size =3D CAMF->data_size; +- CAMF->decoded_data =3D malloc(CAMF->decoded_data_size); ++ CAMF->decoded_data =3D x3f_limited_malloc(CAMF->decoded_data_size); +=20 + for (i =3D 0; i < (int)CAMF->data_size; i++) + { +@@ -1609,7 +1631,7 @@ static void camf_decode_type4(x3f_camf_t *CAMF) +=20 + CAMF->decoded_data_size =3D dst_size; +=20 +- CAMF->decoded_data =3D malloc(CAMF->decoded_data_size); ++ CAMF->decoded_data =3D x3f_limited_malloc(CAMF->decoded_data_size); + memset(CAMF->decoded_data, 0, CAMF->decoded_data_size); +=20 + dst =3D (uint8_t *)CAMF->decoded_data; +@@ -1688,7 +1710,7 @@ static void x3f_load_camf_decode_type4(x3f_camf_t *C= AMF) + for (i =3D 0, p =3D (uint8_t *)CAMF->data; *p !=3D 0; i++) + { + /* TODO: Is this too expensive ??*/ +- element =3D (x3f_true_huffman_element_t *)realloc(element, ++ element =3D (x3f_true_huffman_element_t *)x3f_limited_realloc(element, + (i + 1) * sizeof(*ele= ment)); +=20 + element[i].code_size =3D *p++; +@@ -1729,7 +1751,7 @@ static void camf_decode_type5(x3f_camf_t *CAMF) + int32_t i; +=20 + CAMF->decoded_data_size =3D CAMF->t5.decoded_data_size; +- CAMF->decoded_data =3D malloc(CAMF->decoded_data_size); ++ CAMF->decoded_data =3D x3f_limited_malloc(CAMF->decoded_data_size); +=20 + dst =3D (uint8_t *)CAMF->decoded_data; +=20 +@@ -1753,7 +1775,7 @@ static void x3f_load_camf_decode_type5(x3f_camf_t *C= AMF) + for (i =3D 0, p =3D (uint8_t *)CAMF->data; *p !=3D 0; i++) + { + /* TODO: Is this too expensive ??*/ +- element =3D (x3f_true_huffman_element_t *)realloc(element, ++ element =3D (x3f_true_huffman_element_t *)x3f_limited_realloc(element, + (i + 1) * sizeof(*ele= ment)); +=20 + element[i].code_size =3D *p++; +@@ -1796,8 +1818,8 @@ static void x3f_setup_camf_property_entry(camf_entry= _t *entry) + uint32_t num =3D entry->property_num =3D *(uint32_t *)v; + uint32_t off =3D *(uint32_t *)(v + 4); +=20 +- entry->property_name =3D (char **)malloc(num * sizeof(uint8_t *)); +- entry->property_value =3D (uint8_t **)malloc(num * sizeof(uint8_t *)); ++ entry->property_name =3D (char **)x3f_limited_malloc(num * sizeof(uint8= _t *)); ++ entry->property_value =3D (uint8_t **)x3f_limited_malloc(num * sizeof(u= int8_t *)); +=20 + for (i =3D 0; i < (int)num; i++) + { +@@ -1851,7 +1873,7 @@ static void get_matrix_copy(camf_entry_t *entry) + : sizeof(uint32_t)= ) * + elements; +=20 +- entry->matrix_decoded =3D malloc(size); ++ entry->matrix_decoded =3D x3f_limited_malloc(size); +=20 + switch (element_size) + { +@@ -1921,7 +1943,7 @@ static void x3f_setup_camf_matrix_entry(camf_entry_t= *entry) + uint32_t dim =3D entry->matrix_dim =3D *(uint32_t *)(v + 4); + uint32_t off =3D entry->matrix_data_off =3D *(uint32_t *)(v + 8); + camf_dim_entry_t *dentry =3D entry->matrix_dim_entry =3D +- (camf_dim_entry_t *)malloc(dim * sizeof(camf_dim_entry_t)); ++ (camf_dim_entry_t *)x3f_limited_malloc(dim * sizeof(camf_dim_entry_= t)); +=20 + for (i =3D 0; i < (int)dim; i++) + { +@@ -1972,7 +1994,7 @@ static void x3f_setup_camf_entries(x3f_camf_t *CAMF) + } +=20 + /* TODO: lots of realloc - may be inefficient */ +- entry =3D (camf_entry_t *)realloc(entry, (i + 1) * sizeof(camf_entry_= t)); ++ entry =3D (camf_entry_t *)x3f_limited_realloc(entry, (i + 1) * sizeof= (camf_entry_t)); +=20 + /* Pointer */ + entry[i].entry =3D p; diff -Nru libraw-0.21.4/debian/patches/CVE-2026-5342.patch libraw-0.21.4/de= bian/patches/CVE-2026-5342.patch --- libraw-0.21.4/debian/patches/CVE-2026-5342.patch 1970-01-01 01:00:00.00= 0000000 +0100 +++ libraw-0.21.4/debian/patches/CVE-2026-5342.patch 2026-07-29 03:53:35.00= 0000000 +0200 @@ -0,0 +1,61 @@ +From: Alex Tutubalin <[email protected]> +Date: Tue, 17 Mar 2026 12:44:57 +0300 +Subject: Nikon padded/12bit: no need to calculate padded row size before + final raw_width adjustment + +Origin: https://github.com/LibRaw/LibRaw/commit/2468614a9cbcab6b75ca279ab6= 0cac62156f7aeb +Bug: https://github.com/LibRaw/LibRaw/issues/795 +Bug-Debian: https://bugs.debian.org/1132655 +Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2026-= 5342 +--- + src/decoders/decoders_libraw.cpp | 18 ++++++++++++------ + src/metadata/tiff.cpp | 2 -- + 2 files changed, 12 insertions(+), 8 deletions(-) + +diff --git a/src/decoders/decoders_libraw.cpp b/src/decoders/decoders_libr= aw.cpp +index eb277c3..5a82352 100644 +--- a/src/decoders/decoders_libraw.cpp ++++ b/src/decoders/decoders_libraw.cpp +@@ -259,17 +259,23 @@ void LibRaw::fuji_14bit_load_raw() + void LibRaw::nikon_load_padded_packed_raw() // 12 bit per pixel, padded t= o 16 + // bytes + { ++ unsigned bytesperrow =3D (((unsigned(S.raw_width) * 3u / 2u) + 15u) / 16= u) * 16u; // bytes per row ++ + // libraw_internal_data.unpacker_data.load_flags -> row byte count +- if (libraw_internal_data.unpacker_data.load_flags < 2000 || +- libraw_internal_data.unpacker_data.load_flags > 64000) +- return; ++ if (bytesperrow < 2000 || bytesperrow > 64000) ++ throw LIBRAW_EXCEPTION_IO_CORRUPT; ++ + unsigned char *buf =3D +- (unsigned char *)calloc(libraw_internal_data.unpacker_data.load_fla= gs,1); ++ (unsigned char *)calloc(bytesperrow,1); + for (int row =3D 0; row < S.raw_height; row++) + { + checkCancel(); +- libraw_internal_data.internal_data.input->read( +- buf, libraw_internal_data.unpacker_data.load_flags, 1); ++ int readed =3D libraw_internal_data.internal_data.input->read( ++ buf, 1, bytesperrow); ++ ++ if (readed < (int)bytesperrow) ++ derror(); ++ + for (int icol =3D 0; icol < S.raw_width / 2; icol++) + { + imgdata.rawdata.raw_image[(row)*S.raw_width + (icol * 2)] =3D +diff --git a/src/metadata/tiff.cpp b/src/metadata/tiff.cpp +index 5ec07a2..5ba41ae 100644 +--- a/src/metadata/tiff.cpp ++++ b/src/metadata/tiff.cpp +@@ -2031,8 +2031,6 @@ void LibRaw::apply_tiff() + INT64(tiff_ifd[raw].bytes)) + { + load_raw =3D &LibRaw::nikon_load_padded_packed_raw; +- load_flags =3D (((INT64(raw_width) * 3ULL / 2ULL) + 15ULL) / 16UL= L) * +- 16ULL; // bytes per row + } + else if (!strncmp(model, "NIKON Z 9", 9) && tiff_ifd[raw].offset) + { diff -Nru libraw-0.21.4/debian/patches/series libraw-0.21.4/debian/patches/= series --- libraw-0.21.4/debian/patches/series 1970-01-01 01:00:00.000000000 +0100 +++ libraw-0.21.4/debian/patches/series 2026-07-29 03:53:35.000000000 +0200 @@ -0,0 +1,8 @@ +CVE-2026-21413.patch +CVE-2026-20889.patch +CVE-2026-24660.patch +CVE-2026-24450.patch +CVE-2026-20884/01-afba34ec3.patch +CVE-2026-20884/02-dae685a19.patch +CVE-2026-20884/03-aa4458eb5.patch +CVE-2026-5342.patch diff -Nru libraw-0.21.4/debian/salsa-ci.yml libraw-0.21.4/debian/salsa-ci.y= ml --- libraw-0.21.4/debian/salsa-ci.yml 1970-01-01 01:00:00.000000000 +0100 +++ libraw-0.21.4/debian/salsa-ci.yml 2026-07-29 03:53:35.000000000 +0200 @@ -0,0 +1,9 @@ +--- +include: + - https://salsa.debian.org/salsa-ci-team/pipeline/raw/master/recipes/deb= ian.yml + +variables: + RELEASE: 'trixie' + SALSA_CI_DISABLE_LINTIAN: 1 + SALSA_CI_DISABLE_REPROTEST: 1 + SALSA_CI_DISABLE_USCAN: 1 --OAvz3+Rcct4kXK63-- --XrXWrAvNDSA1+1MR Content-Type: application/pgp-signature; name=signature.asc -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEERpy6p3b9sfzUdbME05pJnDwhpVIFAmpp7XoACgkQ05pJnDwh pVLW6BAAv0sG6bLi0QpvUFgN1HjyZ19bePuTstDTv1taxSkeRvKhrI+qv2dYrtIq UzGrzA/9KfAcKv1ajZZR2tL2ExqC2aUJxTbyuczU4xzp7yJafaFKGqrEuVI9t651 9VJrBqpFZd283VqWt3sgrw2aZi9+Sr+MyIkfsH1kotUjRAkixVe+GkuuCzxCYx7V Oo8t+bwrfs9A/XKF5oDKECovpmXSr8bk14a+lvV+zfkFNAssoR167yZl83rkiT4n zb0UlVQpXA/klwiiTfuzRtalW0cGIxLsX9aljcgRwy9Y71r8slCmGynlTHWwYgp/ Jgs2Of7PfHlvwbUldwnRhhhIYT4vO2MXQNdnmH6fCveUTykfFOVr7abOL/cYXdKb QNNaxWazBppowZMU/zKFkGDQHvm/iW9DQgVNIIx5W0/7hR2qSRVIs7XwomoU23Xa oDAeE98K2MeJOX+WR36AlcEyzfaDaZCvqGoyYWNG8dcfWaD1x/XE9KsP6wCKOL+5 JlXvvr59DITH64K71w6OVcWyhsOWmR31wRj1+P4rT0TR2hcB7T9tCqTmDm3Ul25R 4Xm9f3Q0B81fxbF2xmgCaLqDFxX1K4ENTGbTC8/JHqGYNY/GMdeHAyqc53n/Mnb2 wj0eRuIdtWJ/25RdR4CV8huPzPY1nV32biZk7D1MQT8pj2qXjLc= =0PsA -----END PGP SIGNATURE----- --XrXWrAvNDSA1+1MR--