← Back to branch summary

~jderose/ubuntu/saucy/darktable/merge-1.2.3

« back to all changes in this revision

Viewing changes to debian/patches/0001-fixed-error-handling-for-broken-full-color-images.patch

  • Committer: Package Import Robot
  • Author(s): David Bremner
  • Date: 2013-06-15 06:50:53 UTC
  • mfrom: (8.1.12 sid)
  • Revision ID: package-import@ubuntu.com-20130615065053-qsgthp7t36kuwe41
Tags: 1.2.1-2
http://bugs.debian.org/711316
Bug fix: "CVE-2013-2126: double free", thanks to Raphael Geissert
(Closes: #711316).

Show diffs side-by-side

added added

removed removed

Lines of Context:
debian/patches/0001-fixed-error-handling-for-broken-full-color-images.patch
 
1
From 6365dfd4cb9815eed30aa7fc0e537275563c178c Mon Sep 17 00:00:00 2001
 
2
From: Alex Tutubalin <lexa@lexa.ru>
 
3
Date: Fri, 24 May 2013 23:20:57 +0400
 
4
Subject: [PATCH] fixed error handling for broken full-color images
 
5
 
 
6
(cherry picked from commit e792b3c8a0a1c536b8614883b7e0277e6d5eed83)
 
7
---
 
8
 src/external/LibRaw/src/libraw_cxx.cpp |    8 ++++----
 
9
 1 file changed, 4 insertions(+), 4 deletions(-)
 
10
 
 
11
diff --git a/src/external/LibRaw/src/libraw_cxx.cpp b/src/external/LibRaw/src/libraw_cxx.cpp
 
12
index 218460c..977e40a 100644
 
13
--- a/src/external/LibRaw/src/libraw_cxx.cpp
 
14
+++ b/src/external/LibRaw/src/libraw_cxx.cpp
 
15
@@ -796,8 +796,8 @@ int LibRaw::unpack(void)
 
16
                 S.iheight= S.height;
 
17
                 IO.shrink = 0;
 
18
                 // allocate image as temporary buffer, size 
 
19
-                imgdata.rawdata.raw_alloc = calloc(S.iwidth*S.iheight,sizeof(*imgdata.image));
 
20
-                imgdata.image = (ushort (*)[4]) imgdata.rawdata.raw_alloc;
 
21
+                imgdata.rawdata.raw_alloc = 0;
 
22
+                imgdata.image = (ushort (*)[4]) calloc(S.iwidth*S.iheight,sizeof(*imgdata.image));
 
23
             }
 
24
 
 
25
 
 
26
@@ -807,8 +807,8 @@ int LibRaw::unpack(void)
 
27
         // recover saved
 
28
         if( decoder_info.decoder_flags & LIBRAW_DECODER_LEGACY)
 
29
             {
 
30
-                imgdata.image = 0; 
 
31
-                imgdata.rawdata.color_image = (ushort (*)[4]) imgdata.rawdata.raw_alloc;
 
32
+              imgdata.rawdata.raw_alloc = imgdata.rawdata.color_image = imgdata.image;
 
33
+              imgdata.image = 0; 
 
34
             }
 
35
 
 
36
         // calculate channel maximum
 
37
-- 
 
38
1.7.10.4
 
39