diff options
| author | ace20022 <ace20022@ymail.com> | 2013-09-26 13:37:28 +0200 |
|---|---|---|
| committer | ace20022 <ace20022@ymail.com> | 2013-09-26 13:37:28 +0200 |
| commit | 91e36c2420b1074244347f676a4bdba4732ccc0c (patch) | |
| tree | ff2006aa8daa28f420e446c8db553f45cb096669 | |
| parent | b98c41dc1fc2769d9ebc275ce2be0dc592a4a754 (diff) | |
[cximage] Fix possible "Buffer is accessed out of bounds: romm_cam" error in libdcr.
| -rw-r--r-- | lib/cximage-6.0/raw/libdcr.c | 12 |
1 files changed, 7 insertions, 5 deletions
diff --git a/lib/cximage-6.0/raw/libdcr.c b/lib/cximage-6.0/raw/libdcr.c index 81bf2fb322..ced60c3665 100644 --- a/lib/cximage-6.0/raw/libdcr.c +++ b/lib/cximage-6.0/raw/libdcr.c @@ -4735,7 +4735,7 @@ void DCR_CLASS dcr_romm_coeff (DCRAW* p, float romm_cam[3][3]) void DCR_CLASS dcr_parse_mos (DCRAW* p, int offset) { char data[40]; - int skip, from, i=0, c, neut[4], planes=0, frot=0; + int skip, from, i=0, j, c, neut[4], planes=0, frot=0; static const char *mod[] = { "","DCB2","Volare","Cantare","CMost","Valeo 6","Valeo 11","Valeo 22", "Valeo 11p","Valeo 17","","Aptus 17","Aptus 22","Aptus 75","Aptus 65", @@ -4763,13 +4763,15 @@ void DCR_CLASS dcr_parse_mos (DCRAW* p, int offset) strcpy (p->model, mod[i]); } if (!strcmp(data,"icc_camera_to_tone_matrix")) { - for (i=0; i < 9; i++) - romm_cam[0][i] = dcr_int_to_float(dcr_get4(p)); + for (i=0; i < 3; i++) + for (j=0; j < 3; j++) + romm_cam[i][j] = dcr_int_to_float(dcr_get4(p)); dcr_romm_coeff (p,romm_cam); } if (!strcmp(data,"CaptProf_color_matrix")) { - for (i=0; i < 9; i++) - dcr_fscanf(p->obj_, "%f", &romm_cam[0][i]); + for (i=0; i < 3; i++) + for (j=0; j < 3; j++) + dcr_fscanf(p->obj_, "%f", &romm_cam[i][j]); dcr_romm_coeff (p,romm_cam); } if (!strcmp(data,"CaptProf_number_of_planes")) |