diff --git a/debian/changelog b/debian/changelog index 474f8b88de304d27963fb7ec3731ac05511a61ad..b647a86607bca411f79428135e34d1873867610e 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,9 @@ +libraw (0.19.5-ok6) yangtze; urgency=medium + + * zdongfh321 CVE-2020-35532 安全更新:修复Libraw中的simple_decode_row()函数越界写入 + + -- dongfh321 Fri, 17 Mar 2023 11:42:04 +0800 + libraw (0.19.5-ok5) yangtze; urgency=medium * zhangce1999 CVE-2020-35531 安全更新:get_huffman_diff()函数(libraw\src\x3f\x3f_utils_patched.cpp)在从图像文件读取数据时存在越界读取漏洞。 diff --git a/internal/libraw_x3f.cpp b/internal/libraw_x3f.cpp index 1b386208e560e70895a9ca415b0417cfddc279d6..0467778c67b109bedf93b46bdc00ac66c5ac7f51 100644 --- a/internal/libraw_x3f.cpp +++ b/internal/libraw_x3f.cpp @@ -1484,6 +1484,8 @@ static void simple_decode_row(x3f_info_t *I, x3f_image_data_t *ID = &DEH->data_subsection.image_data; x3f_huffman_t *HUF = ID->huffman; + if (row*row_stride > ID->data_size - (ID->columns*sizeof(uint32_t))) + throw LIBRAW_EXCEPTION_IO_CORRUPT; uint32_t *data = (uint32_t *)((unsigned char*)ID->data + row*row_stride); uint16_t c[3] = {0,0,0};