[SCM] libkdcraw packaging branch, master, updated. debian/4.10.5-1

[Maximiliano Curia]

Gitweb-URL: http://git.debian.org/?p=pkg-kde/kde-sc/libkdcraw.git;a=commitdiff;h=c235a7b

The following commit has been merged in the master branch:
commit c235a7b683f0c2ce0cadf09d9b9ac80ffa87de59
Author: Maximiliano Curia <maxy at debian.org>
Date:   Mon Jun 17 19:10:02 2013 +0200

    New patch: libkdcraw_CVE-2013-2127.diff.
---
 debian/changelog                            |    1 +
 debian/patches/libkdcraw_CVE-2013-2127.diff |   64 +++++++++++++++++++++++++++
 debian/patches/series                       |    1 +
 3 files changed, 66 insertions(+)

diff --git a/debian/changelog b/debian/changelog
index 8a94c0e..9c1d3bf 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,6 +1,7 @@
 libkdcraw (4:4.10.4-2) UNRELEASED; urgency=low
 
   * New patch: libkdcraw_CVE-2013-2126.diff. (Closes: #711317)
+  * New patch: libkdcraw_CVE-2013-2127.diff.
 
  -- Maximiliano Curia <maxy at debian.org>  Mon, 17 Jun 2013 16:29:09 +0200
 
diff --git a/debian/patches/libkdcraw_CVE-2013-2127.diff b/debian/patches/libkdcraw_CVE-2013-2127.diff
new file mode 100644
index 0000000..e3cb167
--- /dev/null
+++ b/debian/patches/libkdcraw_CVE-2013-2127.diff
@@ -0,0 +1,64 @@
+commit b990522ec738deafd92f2b6ff179a1957edf8fc5
+Author: Maximiliano Curia <maxy at debian.org>
+Date:   Mon Jun 17 18:29:49 2013 +0200
+
+    CVE-2013-2127: buffer overflow, fix from: https://github.com/LibRaw/LibRaw/commit/2f912f5b33582961b1cdbd9fd828589f8b78f21d
+
+diff --git a/libraw/src/libraw_cxx.cpp b/libraw/src/libraw_cxx.cpp
+index 785db91..a53df26 100644
+--- a/libraw/src/libraw_cxx.cpp
++++ b/libraw/src/libraw_cxx.cpp
+@@ -2198,14 +2198,15 @@ void LibRaw::subtract_black()
+ #define MAX(a,b) ((a) > (b) ? (a) : (b))
+ #define LIM(x,min,max) MAX(min,MIN(x,max))
+ #define CLIP(x) LIM(x,0,65535)
+-
+-            for(i=0; i< size*4; i++)
++			int dmax = 0;
++			for(i=0; i< size*4; i++)
+               {
+                 int val = imgdata.image[0][i];
+                 val -= cblk[i & 3];
+                 imgdata.image[0][i] = CLIP(val);
+-                if(C.data_maximum < val) C.data_maximum = val;
++                if(dmax < val) dmax = val;
+               }
++			C.data_maximum = dmax & 0xffff;
+ #undef MIN
+ #undef MAX
+ #undef LIM
+@@ -2221,9 +2222,10 @@ void LibRaw::subtract_black()
+           // only calculate channel maximum;
+           int idx;
+           ushort *p = (ushort*)imgdata.image;
+-          C.data_maximum = 0;
++		  int dmax = 0;
+           for(idx=0;idx<S.iheight*S.iwidth*4;idx++)
+-            if(C.data_maximum < p[idx]) C.data_maximum = p[idx];
++            if(dmax < p[idx]) dmax = p[idx];
++		  C.data_maximum = dmax;
+         }
+ }
+ 
+@@ -2277,8 +2279,10 @@ void LibRaw::exp_bef(float shift, float smooth)
+             imgdata.image[i][3] = lut[imgdata.image[i][3]];
+         }
+ 
+-    C.data_maximum = lut[C.data_maximum];
+-    C.maximum = lut[C.maximum];
++	if(C.data_maximum <=TBLN)
++		C.data_maximum = lut[C.data_maximum];
++	if(C.maximum <= TBLN)
++		C.maximum = lut[C.maximum];
+     // no need to adjust the minumum, black is already subtracted
+     free(lut);
+ }
+@@ -2386,7 +2390,7 @@ int LibRaw::dcraw_process(void)
+ 
+         raw2image_ex(subtract_inline); // allocate imgdata.image and copy data!
+ 
+-        int save_4color = O.four_color_rgb;
++		int save_4color = O.four_color_rgb;
+ 
+         if (IO.zero_is_bad) 
+           {
diff --git a/debian/patches/series b/debian/patches/series
index 560105e..9240677 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -1 +1,2 @@
 libkdcraw_CVE-2013-2126.diff
+libkdcraw_CVE-2013-2127.diff

-- 
libkdcraw packaging