From 42b176bc588e53bb10cbde512568e8cd569780d7 Mon Sep 17 00:00:00 2001
From: CentOS Sources <bugs@centos.org>
Date: Jan 23 2024 15:59:10 +0000
Subject: import LibRaw-0.19.4-2.el7_9


---

diff --git a/SOURCES/LibRaw-check-for-input-buffer-size-on-datastream-gets.patch b/SOURCES/LibRaw-check-for-input-buffer-size-on-datastream-gets.patch
new file mode 100644
index 0000000..c09a47e
--- /dev/null
+++ b/SOURCES/LibRaw-check-for-input-buffer-size-on-datastream-gets.patch
@@ -0,0 +1,41 @@
+From 85e018cbca5eb3743eddca91d3d40c3123fa9777 Mon Sep 17 00:00:00 2001
+From: Debarshi Ray <debarshir@gnome.org>
+Date: Tue, 19 Sep 2023 19:52:40 +0200
+Subject: [PATCH] check for input buffer size on datastream::gets
+
+(backported from commit fa329f37dca4a2c938f8abb50ee4a7ef93e64fbb)
+---
+ src/libraw_datastream.cpp | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/src/libraw_datastream.cpp b/src/libraw_datastream.cpp
+index bd9cf5ee55d7..aecd3997a707 100644
+--- a/src/libraw_datastream.cpp
++++ b/src/libraw_datastream.cpp
+@@ -175,6 +175,7 @@ INT64 LibRaw_file_datastream::tell()
+ 
+ char *LibRaw_file_datastream::gets(char *str, int sz)
+ {
++  if(sz<1) return NULL;
+   if (substream)
+     return substream->gets(str, sz);
+   LR_STREAM_CHK();
+@@ -398,6 +399,7 @@ INT64 LibRaw_buffer_datastream::tell()
+ 
+ char *LibRaw_buffer_datastream::gets(char *s, int sz)
+ {
++  if(sz<1) return NULL;
+   if (substream)
+     return substream->gets(s, sz);
+   unsigned char *psrc, *pdest, *str;
+@@ -594,6 +596,7 @@ INT64 LibRaw_bigfile_datastream::tell()
+ 
+ char *LibRaw_bigfile_datastream::gets(char *str, int sz)
+ {
++  if(sz<1) return NULL;
+   LR_BF_CHK();
+   return substream ? substream->gets(str, sz) : fgets(str, sz, f);
+ }
+-- 
+2.41.0
+
diff --git a/SPECS/LibRaw.spec b/SPECS/LibRaw.spec
index 7bbfa7c..b0e6278 100644
--- a/SPECS/LibRaw.spec
+++ b/SPECS/LibRaw.spec
@@ -1,7 +1,7 @@
 Summary: Library for reading RAW files obtained from digital photo cameras
 Name: LibRaw
 Version: 0.19.4
-Release: 1%{?dist}
+Release: 2%{?dist}
 License: BSD and (CDDL or LGPLv2)
 URL: http://www.libraw.org
 
@@ -12,7 +12,13 @@ BuildRequires: pkgconfig(libjpeg)
 BuildRequires: autoconf automake libtool
 
 Source0: http://www.libraw.org/data/%{name}-%{version}.tar.gz
+
 Patch0:  LibRaw-0.6.0-pkgconfig.patch
+
+# https://issues.redhat.com/browse/RHEL-9524
+# https://github.com/LibRaw/LibRaw/pull/611
+Patch1: LibRaw-check-for-input-buffer-size-on-datastream-gets.patch
+
 Provides: bundled(dcraw) = 9.25
 
 %description
@@ -52,6 +58,7 @@ LibRaw sample programs
 %setup -q
 
 %patch0 -p0 -b .pkgconfig
+%patch1 -p1 -b .cve-2021-32142
 
 %build
 autoreconf -if
@@ -116,6 +123,10 @@ rm -fv %{buildroot}%{_libdir}/lib*.la
 
 
 %changelog
+* Mon Oct 23 2023 Debarshi Ray <rishi@fedoraproject.org> - 0.19.4-2
+- Fix CVE-2021-32142
+- Resolves: RHEL-9524
+
 * Wed Aug 14 2019 Debarshi Ray <rishi@fedoraproject.org> - 0.19.4-1
 - Update to 0.19.4
 - Resolves: #1741274