Description: stack-based buffer overflow bug Bug-Debian: https://bugs.debian.org/890086 Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2018-19655 Author: Filip Hroch Reviewed-by: Salvatore Bonaccorso Last-Update: 2018-12-02 --- a/dcraw.cc +++ b/dcraw.cc @@ -8505,9 +8505,15 @@ float CLASS find_green (int bps, int bit { UINT64 bitbuf=0; int vbits, col, i, c; - ushort img[2][2064]; + ushort *img; double sum[]={0,0}; +#define IMG2D(row,col) \ + img[(row)*width+(col)] + + img = (ushort *) malloc(2*width*sizeof(ushort)); + merror (img, "find_green()"); + FORC(2) { fseek (ifp, c ? off1:off0, SEEK_SET); for (vbits=col=0; col < width; col++) { @@ -8516,13 +8522,14 @@ float CLASS find_green (int bps, int bit for (i=0; i < bite; i+=8) bitbuf |= (unsigned) (fgetc(ifp) << i); } - img[c][col] = bitbuf << (64-bps-vbits) >> (64-bps); + IMG2D(c,col) = bitbuf << (64-bps-vbits) >> (64-bps); } } FORC(width-1) { - sum[ c & 1] += ABS(img[0][c]-img[1][c+1]); - sum[~c & 1] += ABS(img[1][c]-img[0][c+1]); + sum[ c & 1] += ABS(IMG2D(0,c)-IMG2D(1,c+1)); + sum[~c & 1] += ABS(IMG2D(1,c)-IMG2D(0,c+1)); } + free(img); return 100 * log(sum[0]/sum[1]); }