diff options
| author | ace20022 <ace20022@ymail.com> | 2013-09-26 13:20:35 +0200 |
|---|---|---|
| committer | ace20022 <ace20022@ymail.com> | 2013-09-26 13:30:27 +0200 |
| commit | 5793e7b08f59692958a92be7592d033ab6248ac1 (patch) | |
| tree | f0417e63a02dd12dba1f143338e75bef6509243c /lib/cximage-6.0 | |
| parent | a4dcd8b0eb7f61059221d3113cdce8a1e72c736e (diff) | |
[cximage] Fix possible "Buffer is accessed out of bounds: romm_cam" error in dcraw.
Diffstat (limited to 'lib/cximage-6.0')
| -rw-r--r-- | lib/cximage-6.0/raw/dcraw.c | 12 |
1 files changed, 7 insertions, 5 deletions
diff --git a/lib/cximage-6.0/raw/dcraw.c b/lib/cximage-6.0/raw/dcraw.c index d57b9151a4..61707095c8 100644 --- a/lib/cximage-6.0/raw/dcraw.c +++ b/lib/cximage-6.0/raw/dcraw.c @@ -4774,7 +4774,7 @@ void CLASS romm_coeff (float romm_cam[3][3]) void CLASS parse_mos (int offset) { char data[40]; - int skip, from, i, c, neut[4], planes=0, frot=0; + int skip, from, i, j, c, neut[4], planes=0, frot=0; static const char *mod[] = { "","DCB2","Volare","Cantare","CMost","Valeo 6","Valeo 11","Valeo 22", "Valeo 11p","Valeo 17","","Aptus 17","Aptus 22","Aptus 75","Aptus 65", @@ -4802,13 +4802,15 @@ void CLASS parse_mos (int offset) strcpy (model, mod[i]); } if (!strcmp(data,"icc_camera_to_tone_matrix")) { - for (i=0; i < 9; i++) - romm_cam[0][i] = int_to_float(get4()); + for (i=0; i < 3; i++) + for (j=0; j < 3; j++) + romm_cam[i][j] = int_to_float(get4()); romm_coeff (romm_cam); } if (!strcmp(data,"CaptProf_color_matrix")) { - for (i=0; i < 9; i++) - fscanf (ifp, "%f", &romm_cam[0][i]); + for (i=0; i < 3; i++) + for (j=0; j < 3; j++) + fscanf (ifp, "%f", &romm_cam[i][j]); romm_coeff (romm_cam); } if (!strcmp(data,"CaptProf_number_of_planes")) |