Blame SOURCES/dcraw-CVE-2018-19655.patch
|
 |
2cf66c |
Author: Filip Hroch <hroch@physics.muni.cz>
|
|
|
2cf66c |
Description: stack-based buffer overflow bug
|
|
|
2cf66c |
--- a/dcraw.c
|
|
|
2cf66c |
+++ b/dcraw.c
|
|
|
2cf66c |
@@ -8345,9 +8345,15 @@
|
|
|
2cf66c |
{
|
|
|
2cf66c |
UINT64 bitbuf=0;
|
|
|
2cf66c |
int vbits, col, i, c;
|
|
|
2cf66c |
- ushort img[2][2064];
|
|
|
2cf66c |
+ ushort *img;
|
|
|
2cf66c |
double sum[]={0,0};
|
|
|
2cf66c |
|
|
|
2cf66c |
+#define IMG2D(row,col) \
|
|
|
2cf66c |
+ img[(row)*width+(col)]
|
|
|
2cf66c |
+
|
|
|
2cf66c |
+ img = (ushort *) malloc(2*width*sizeof(ushort));
|
|
|
2cf66c |
+ merror (img, "find_green()");
|
|
|
2cf66c |
+
|
|
|
2cf66c |
FORC(2) {
|
|
|
2cf66c |
fseek (ifp, c ? off1:off0, SEEK_SET);
|
|
|
2cf66c |
for (vbits=col=0; col < width; col++) {
|
|
|
2cf66c |
@@ -8356,13 +8362,14 @@
|
|
|
2cf66c |
for (i=0; i < bite; i+=8)
|
|
|
2cf66c |
bitbuf |= (unsigned) (fgetc(ifp) << i);
|
|
|
2cf66c |
}
|
|
|
2cf66c |
- img[c][col] = bitbuf << (64-bps-vbits) >> (64-bps);
|
|
|
2cf66c |
+ IMG2D(c,col) = bitbuf << (64-bps-vbits) >> (64-bps);
|
|
|
2cf66c |
}
|
|
|
2cf66c |
}
|
|
|
2cf66c |
FORC(width-1) {
|
|
|
2cf66c |
- sum[ c & 1] += ABS(img[0][c]-img[1][c+1]);
|
|
|
2cf66c |
- sum[~c & 1] += ABS(img[1][c]-img[0][c+1]);
|
|
|
2cf66c |
+ sum[ c & 1] += ABS(IMG2D(0,c)-IMG2D(1,c+1));
|
|
|
2cf66c |
+ sum[~c & 1] += ABS(IMG2D(1,c)-IMG2D(0,c+1));
|
|
|
2cf66c |
}
|
|
|
2cf66c |
+ free(img);
|
|
|
2cf66c |
return 100 * log(sum[0]/sum[1]);
|
|
|
2cf66c |
}
|
|
|
2cf66c |
|