!78 [sync] PR-76: Fix CVE-2025-43961,CVE-2025-43962 and CVE-2025-43964
From: @openeuler-sync-bot Reviewed-by: @wk333 Signed-off-by: @wk333
This commit is contained in:
openeuler-ci-bot
Gitee
commit
c37de1aaa7
105
CVE-2025-43961_CVE-2025-43962.patch
Normal file
105
CVE-2025-43961_CVE-2025-43962.patch
Normal file
@ -0,0 +1,105 @@
|
||||
From: Alex Tutubalin <lexa@lexa.ru>
|
||||
Date: Sat, 1 Feb 2025 15:32:39 +0300
|
||||
Subject: Prevent out-of-bounds read in fuji 0xf00c tag parser
|
||||
|
||||
Prevent out-of-bounds read in fuji 0xf00c tag parser
|
||||
|
||||
prevent OOB reads in phase_one_correct
|
||||
|
||||
(cherry picked from commit 66fe663e02a4dd610b4e832f5d9af326709336c2)
|
||||
---
|
||||
src/decoders/load_mfbacks.cpp | 18 ++++++++++++++----
|
||||
src/metadata/tiff.cpp | 27 +++++++++++++++++----------
|
||||
2 files changed, 31 insertions(+), 14 deletions(-)
|
||||
|
||||
diff --git a/src/decoders/load_mfbacks.cpp b/src/decoders/load_mfbacks.cpp
|
||||
index 9d7c051..ded154c 100644
|
||||
--- a/src/decoders/load_mfbacks.cpp
|
||||
+++ b/src/decoders/load_mfbacks.cpp
|
||||
@@ -331,6 +331,9 @@ int LibRaw::phase_one_correct()
|
||||
fseek(ifp, off_412, SEEK_SET);
|
||||
for (i = 0; i < 9; i++)
|
||||
head[i] = get4() & 0x7fff;
|
||||
+ unsigned w0 = head[1] * head[3], w1 = head[2] * head[4];
|
||||
+ if (w0 > 10240000 || w1 > 10240000)
|
||||
+ throw LIBRAW_EXCEPTION_ALLOC;
|
||||
yval[0] = (float *)calloc(head[1] * head[3] + head[2] * head[4], 6);
|
||||
merror(yval[0], "phase_one_correct()");
|
||||
yval[1] = (float *)(yval[0] + head[1] * head[3]);
|
||||
@@ -356,10 +359,17 @@ int LibRaw::phase_one_correct()
|
||||
for (k = j = 0; j < head[1]; j++)
|
||||
if (num < xval[0][k = head[1] * i + j])
|
||||
break;
|
||||
- frac = (j == 0 || j == head[1])
|
||||
- ? 0
|
||||
- : (xval[0][k] - num) / (xval[0][k] - xval[0][k - 1]);
|
||||
- mult[i - cip] = yval[0][k - 1] * frac + yval[0][k] * (1 - frac);
|
||||
+ if (j == 0 || j == head[1] || k < 1 || k >= w0+w1)
|
||||
+ frac = 0;
|
||||
+ else
|
||||
+ {
|
||||
+ int xdiv = (xval[0][k] - xval[0][k - 1]);
|
||||
+ frac = xdiv ? (xval[0][k] - num) / (xval[0][k] - xval[0][k - 1]) : 0;
|
||||
+ }
|
||||
+ if (k < w0 + w1)
|
||||
+ mult[i - cip] = yval[0][k > 0 ? k - 1 : 0] * frac + yval[0][k] * (1 - frac);
|
||||
+ else
|
||||
+ mult[i - cip] = 0;
|
||||
}
|
||||
i = ((mult[0] * (1 - cfrac) + mult[1] * cfrac) * row + num) * 2;
|
||||
RAW(row, col) = LIM(i, 0, 65535);
|
||||
diff --git a/src/metadata/tiff.cpp b/src/metadata/tiff.cpp
|
||||
index cd2406d..53a8c04 100644
|
||||
--- a/src/metadata/tiff.cpp
|
||||
+++ b/src/metadata/tiff.cpp
|
||||
@@ -980,18 +980,21 @@ int LibRaw::parse_tiff_ifd(int base)
|
||||
if ((fwb[0] == rafdata[fi]) && (fwb[1] == rafdata[fi + 1]) &&
|
||||
(fwb[2] == rafdata[fi + 2]))
|
||||
{
|
||||
- if (rafdata[fi - 15] !=
|
||||
+ if (fi > 14 && rafdata[fi - 15] !=
|
||||
fwb[0]) // 15 is offset of Tungsten WB from the first
|
||||
// preset, Fine Weather WB
|
||||
continue;
|
||||
- for (int wb_ind = 0, ofst = fi - 15; wb_ind < Fuji_wb_list1.size();
|
||||
- wb_ind++, ofst += 3)
|
||||
- {
|
||||
- icWBC[Fuji_wb_list1[wb_ind]][1] =
|
||||
- icWBC[Fuji_wb_list1[wb_ind]][3] = rafdata[ofst];
|
||||
- icWBC[Fuji_wb_list1[wb_ind]][0] = rafdata[ofst + 1];
|
||||
- icWBC[Fuji_wb_list1[wb_ind]][2] = rafdata[ofst + 2];
|
||||
- }
|
||||
+ if (fi >= 15)
|
||||
+ {
|
||||
+ for (int wb_ind = 0, ofst = fi - 15; wb_ind < (int)Fuji_wb_list1.size();
|
||||
+ wb_ind++, ofst += 3)
|
||||
+ {
|
||||
+ icWBC[Fuji_wb_list1[wb_ind]][1] =
|
||||
+ icWBC[Fuji_wb_list1[wb_ind]][3] = rafdata[ofst];
|
||||
+ icWBC[Fuji_wb_list1[wb_ind]][0] = rafdata[ofst + 1];
|
||||
+ icWBC[Fuji_wb_list1[wb_ind]][2] = rafdata[ofst + 2];
|
||||
+ }
|
||||
+ }
|
||||
|
||||
if ((imFuji.RAFDataVersion == 0x0260) || // X-Pro3
|
||||
(imFuji.RAFDataVersion == 0x0261) || // X100V
|
||||
@@ -1000,6 +1003,8 @@ int LibRaw::parse_tiff_ifd(int base)
|
||||
fi += 96;
|
||||
for (fj = fi; fj < (fi + 15); fj += 3)
|
||||
{
|
||||
+ if (fj > libraw_internal_data.unpacker_data.lenRAFData - 3)
|
||||
+ break;
|
||||
if (rafdata[fj] != rafdata[fi])
|
||||
{
|
||||
fj -= 93;
|
||||
@@ -1009,7 +1014,9 @@ int LibRaw::parse_tiff_ifd(int base)
|
||||
(imFuji.RAFDataVersion == 0x0261) || // X100V
|
||||
(imFuji.RAFDataVersion == 0x0262)) // X-T4
|
||||
fj -= 9;
|
||||
- for (int iCCT = 0, ofst = fj; iCCT < 31;
|
||||
+//printf ("wb start in DNG: 0x%04x\n", fj*2-0x4e);
|
||||
+ for (int iCCT = 0, ofst = fj; iCCT < 31
|
||||
+ && ofst < libraw_internal_data.unpacker_data.lenRAFData - 3;
|
||||
iCCT++, ofst += 3)
|
||||
{
|
||||
icWBCCTC[iCCT][0] = FujiCCT_K[iCCT];
|
||||
22
CVE-2025-43964.patch
Normal file
22
CVE-2025-43964.patch
Normal file
@ -0,0 +1,22 @@
|
||||
From: Alex Tutubalin <lexa@lexa.ru>
|
||||
Date: Sun, 2 Mar 2025 11:35:43 +0300
|
||||
Subject: additional checks in PhaseOne correction tag 0x412 processing
|
||||
|
||||
(cherry picked from commit a50dc3f1127d2e37a9b39f57ad9bb2ebb60f18c0)
|
||||
---
|
||||
src/decoders/load_mfbacks.cpp | 2 ++
|
||||
1 file changed, 2 insertions(+)
|
||||
|
||||
diff --git a/src/decoders/load_mfbacks.cpp b/src/decoders/load_mfbacks.cpp
|
||||
index 61eedeb..db0dc74 100644
|
||||
--- a/src/decoders/load_mfbacks.cpp
|
||||
+++ b/src/decoders/load_mfbacks.cpp
|
||||
@@ -336,6 +336,8 @@ int LibRaw::phase_one_correct()
|
||||
unsigned w0 = head[1] * head[3], w1 = head[2] * head[4];
|
||||
if (w0 > 10240000 || w1 > 10240000)
|
||||
throw LIBRAW_EXCEPTION_ALLOC;
|
||||
+ if (w0 < 1 || w1 < 1)
|
||||
+ throw LIBRAW_EXCEPTION_IO_CORRUPT;
|
||||
yval[0] = (float *)calloc(head[1] * head[3] + head[2] * head[4], 6);
|
||||
merror(yval[0], "phase_one_correct()");
|
||||
yval[1] = (float *)(yval[0] + head[1] * head[3]);
|
||||
@ -1,6 +1,6 @@
|
||||
Name: LibRaw
|
||||
Version: 0.20.2
|
||||
Release: 8
|
||||
Release: 9
|
||||
Summary: Library for reading RAW files obtained from digital photo cameras
|
||||
License: BSD and (CDDL-1.0 or LGPLv2)
|
||||
URL: http://www.libraw.org
|
||||
@ -14,6 +14,8 @@ Patch0005: CVE-2023-1729.patch
|
||||
# https://github.com/LibRaw/LibRaw/commit/bc3aaf4223fdb70d52d470dae65c5a7923ea2a49
|
||||
Patch0006: CVE-2021-32142.patch
|
||||
Patch0007: backport-upstream_CVE-2025-43963.patch
|
||||
Patch0008: CVE-2025-43961_CVE-2025-43962.patch
|
||||
Patch0009: CVE-2025-43964.patch
|
||||
|
||||
BuildRequires: gcc-c++ pkgconfig(lcms2) pkgconfig(libjpeg)
|
||||
BuildRequires: autoconf automake libtool
|
||||
@ -75,6 +77,9 @@ rm -rfv samples/.deps samples/.dirstamp samples/*.o
|
||||
%exclude %{_docdir}/libraw/*
|
||||
|
||||
%changelog
|
||||
* Tue May 06 2025 yaoxin <1024769339@qq.com> - 0.20.2-9
|
||||
- Fix CVE-2025-43961,CVE-2025-43962 and CVE-2025-43964
|
||||
|
||||
* Mon Apr 21 2025 hdliu <hdliu@linx-info.com> - 0.20.2-8
|
||||
- Fix CVE-2025-43963
|
||||
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user