← Back to branch summary

~jderose/ubuntu/saucy/darktable/merge-1.2.3

« back to all changes in this revision

Viewing changes to src/external/LibRaw/src/libraw_cxx.cpp

  • Committer: Package Import Robot
  • Author(s): David Bremner
  • Date: 2013-06-15 06:50:53 UTC
  • mfrom: (8.1.12 sid)
  • Revision ID: package-import@ubuntu.com-20130615065053-qsgthp7t36kuwe41
Tags: 1.2.1-2
http://bugs.debian.org/711316
Bug fix: "CVE-2013-2126: double free", thanks to Raphael Geissert
(Closes: #711316).

Show diffs side-by-side

added added

removed removed

Lines of Context:
src/external/LibRaw/src/libraw_cxx.cpp
796
796
                S.iheight= S.height;
797
797
                IO.shrink = 0;
798
798
                // allocate image as temporary buffer, size 
799
 
                imgdata.rawdata.raw_alloc = calloc(S.iwidth*S.iheight,sizeof(*imgdata.image));
800
 
                imgdata.image = (ushort (*)[4]) imgdata.rawdata.raw_alloc;
 
799
                imgdata.rawdata.raw_alloc = 0;
 
800
                imgdata.image = (ushort (*)[4]) calloc(S.iwidth*S.iheight,sizeof(*imgdata.image));
801
801
            }
802
802
 
803
803
 
807
807
        // recover saved
808
808
        if( decoder_info.decoder_flags & LIBRAW_DECODER_LEGACY)
809
809
            {
810
 
                imgdata.image = 0; 
811
 
                imgdata.rawdata.color_image = (ushort (*)[4]) imgdata.rawdata.raw_alloc;
 
810
              imgdata.rawdata.raw_alloc = imgdata.rawdata.color_image = imgdata.image;
 
811
              imgdata.image = 0; 
812
812
            }
813
813
 
814
814
        // calculate channel maximum