--- Begin Message ---
Package: release.debian.org
Severity: normal
Tags: trixie
X-Debbugs-Cc: [email protected]
Control: affects -1 + src:libraw
User: [email protected]
Usertags: pu
[ Reason ]
Fix <no-dsa> issues CVE-2026-5342, CVE-2026-20884, CVE-2026-20889,
CVE-2026-21413, CVE-2026-24450 and CVE-2026-24660.
[ Impact ]
Users will remain vulnerable to the afformentioned issues, and will
regress when upgrading upgrading (a fix was uploaded to Bookworm LTS and
Bullseye LTS as part of DLA-4704-1).
[ Tests ]
Manual tests only using the reporter's PoC information. AFAICT neither
the package nor the upstream code have an automated test suite.
[ Risks ]
Low risk, all changes have been backported from upstream's 0.22.1
version and trivially apply to trixie's 0.21.4 codebase.
[ Checklist ]
[x] *all* changes are documented in the d/changelog
[x] I reviewed all changes and I approve them
[x] attach debdiff against the package in stable
[x] the issue is verified as fixed in unstable
[ Changes ]
* Fix CVE-2026-5342: nikon_load_padded_packed_raw() out-of-bounds read
due to missing buffer and dimension validation (closes: #1132655).
* Fix CVE-2026-20884: deflate_dng_load_raw() integer overflow vulnerability
(closes: #1133845).
* Fix CVE-2026-20889: x3f_thumb_loader() heap-based buffer overflow
vulnerability (closes: #1133845).
* Fix CVE-2026-21413: lossless_jpeg_load_raw() heap-based buffer overflow
vulnerability (closes: #1133845).
* Fix CVE-2026-24450: uncompressed_fp_dng_load_raw() integer overflow
vulnerability (closes: #1133845).
* Fix CVE-2026-24660: x3f_load_huffman() heap-based buffer overflow
vulnerability (closes: #1133845).
* Add d/salsa-ci.yml for Salsa CI.
[ Other info ]
Debusine workflow output:
https://debusine.debian.net/debian/developers/work-request/940417/
Individual commits and tag can be found on the LTS team fork at
https://salsa.debian.org/lts-team/packages/libraw/-/tree/debian/trixie?ref_type=heads
--
Guilhem.
diffstat for libraw-0.21.4 libraw-0.21.4
changelog | 19 +
patches/CVE-2026-20884/01-afba34ec3.patch | 69 ++++++
patches/CVE-2026-20884/02-dae685a19.patch | 36 +++
patches/CVE-2026-20884/03-aa4458eb5.patch | 61 +++++
patches/CVE-2026-20889.patch | 96 ++++++++
patches/CVE-2026-21413.patch | 33 ++
patches/CVE-2026-24450.patch | 55 ++++
patches/CVE-2026-24660.patch | 335 ++++++++++++++++++++++++++++++
patches/CVE-2026-5342.patch | 61 +++++
patches/series | 8
salsa-ci.yml | 9
11 files changed, 782 insertions(+)
diff -Nru libraw-0.21.4/debian/changelog libraw-0.21.4/debian/changelog
--- libraw-0.21.4/debian/changelog 2025-04-24 15:52:02.000000000 +0200
+++ libraw-0.21.4/debian/changelog 2026-07-29 03:53:35.000000000 +0200
@@ -1,3 +1,22 @@
+libraw (0.21.4-2+deb13u1) trixie; urgency=high
+
+ * Non-maintainer upload.
+ * Fix CVE-2026-5342: nikon_load_padded_packed_raw() out-of-bounds read
+ due to missing buffer and dimension validation (closes: #1132655).
+ * Fix CVE-2026-20884: deflate_dng_load_raw() integer overflow vulnerability
+ (closes: #1133845).
+ * Fix CVE-2026-20889: x3f_thumb_loader() heap-based buffer overflow
+ vulnerability (closes: #1133845).
+ * Fix CVE-2026-21413: lossless_jpeg_load_raw() heap-based buffer overflow
+ vulnerability (closes: #1133845).
+ * Fix CVE-2026-24450: uncompressed_fp_dng_load_raw() integer overflow
+ vulnerability (closes: #1133845).
+ * Fix CVE-2026-24660: x3f_load_huffman() heap-based buffer overflow
+ vulnerability (closes: #1133845).
+ * Add d/salsa-ci.yml for Salsa CI.
+
+ -- Guilhem Moulin <[email protected]> Wed, 29 Jul 2026 03:53:35 +0200
+
libraw (0.21.4-2) unstable; urgency=medium
* Team upload.
diff -Nru libraw-0.21.4/debian/patches/CVE-2026-20884/01-afba34ec3.patch libraw-0.21.4/debian/patches/CVE-2026-20884/01-afba34ec3.patch
--- libraw-0.21.4/debian/patches/CVE-2026-20884/01-afba34ec3.patch 1970-01-01 01:00:00.000000000 +0100
+++ libraw-0.21.4/debian/patches/CVE-2026-20884/01-afba34ec3.patch 2026-07-29 03:53:35.000000000 +0200
@@ -0,0 +1,69 @@
+From: Alex Tutubalin <[email protected]>
+Date: Sun, 28 Dec 2025 19:18:36 +0300
+Subject: implemented RAW size limit check and allocation result check for
+ 4-shot pentax loaded and FP-dng loader
+
+Origin: https://github.com/LibRaw/LibRaw/commit/afba34ec30bf6409891dc096f6be69155ecf6bdb
+Bug: https://talosintelligence.com/vulnerability_reports/TALOS-2026-2364
+Bug-Debian: https://bugs.debian.org/1133845
+Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2026-20884
+---
+ src/decoders/decoders_libraw.cpp | 12 ++++++++++--
+ src/decoders/fp_dng.cpp | 9 ++++++++-
+ 2 files changed, 18 insertions(+), 3 deletions(-)
+
+diff --git a/src/decoders/decoders_libraw.cpp b/src/decoders/decoders_libraw.cpp
+index 952e41a..eb277c3 100644
+--- a/src/decoders/decoders_libraw.cpp
++++ b/src/decoders/decoders_libraw.cpp
+@@ -54,6 +54,10 @@ void LibRaw::sony_arq_load_raw()
+
+ void LibRaw::pentax_4shot_load_raw()
+ {
++ size_t alloc_sz = size_t(imgdata.sizes.raw_width) * (size_t(imgdata.sizes.raw_height) + 16) * 4 * sizeof(ushort);
++ if (INT64(alloc_sz) > INT64(imgdata.rawparams.max_raw_memory_mb) * INT64(1024 * 1024))
++ throw LIBRAW_EXCEPTION_TOOBIG;
++
+ #ifdef LIBRAW_CALLOC_RAWSTORE
+ ushort *plane = (ushort *)calloc(size_t(imgdata.sizes.raw_width) *
+ size_t(imgdata.sizes.raw_height), sizeof(ushort));
+@@ -61,13 +65,17 @@ void LibRaw::pentax_4shot_load_raw()
+ ushort *plane = (ushort *)malloc(size_t(imgdata.sizes.raw_width) *
+ size_t(imgdata.sizes.raw_height) * sizeof(ushort));
+ #endif
+- int alloc_sz = imgdata.sizes.raw_width * (imgdata.sizes.raw_height + 16) * 4 *
+- sizeof(ushort);
++ if (!plane)
++ throw LIBRAW_EXCEPTION_ALLOC;
++
+ #ifdef LIBRAW_CALLOC_RAWSTORE
+ ushort(*result)[4] = (ushort(*)[4])calloc(alloc_sz,1);
+ #else
+ ushort(*result)[4] = (ushort(*)[4])malloc(alloc_sz);
+ #endif
++ if(!result)
++ throw LIBRAW_EXCEPTION_ALLOC;
++
+ struct movement_t
+ {
+ int row, col;
+diff --git a/src/decoders/fp_dng.cpp b/src/decoders/fp_dng.cpp
+index 4bb8f42..6f82e89 100644
+--- a/src/decoders/fp_dng.cpp
++++ b/src/decoders/fp_dng.cpp
+@@ -350,7 +350,14 @@ void LibRaw::deflate_dng_load_raw()
+ libraw_internal_data.internal_data.input);
+
+ if (ifd->sample_format == 3)
+- float_raw_image = (float *)calloc(tiles.tileCnt * tiles.tileWidth * tiles.tileHeight *ifd->samples, sizeof(float));
++ {
++ INT64 raw_bytes = tiles.tileCnt * tiles.tileWidth * tiles.tileHeight * ifd->samples * sizeof(float);
++ if (raw_bytes > INT64(imgdata.rawparams.max_raw_memory_mb) * INT64(1024 * 1024))
++ throw LIBRAW_EXCEPTION_TOOBIG;
++ float_raw_image = (float *)calloc(tiles.tileCnt * tiles.tileWidth * tiles.tileHeight * ifd->samples, sizeof(float));
++ if (!float_raw_image)
++ throw LIBRAW_EXCEPTION_ALLOC;
++ }
+ else
+ throw LIBRAW_EXCEPTION_DECODE_RAW; // Only float deflated supported
+
diff -Nru libraw-0.21.4/debian/patches/CVE-2026-20884/02-dae685a19.patch libraw-0.21.4/debian/patches/CVE-2026-20884/02-dae685a19.patch
--- libraw-0.21.4/debian/patches/CVE-2026-20884/02-dae685a19.patch 1970-01-01 01:00:00.000000000 +0100
+++ libraw-0.21.4/debian/patches/CVE-2026-20884/02-dae685a19.patch 2026-07-29 03:53:35.000000000 +0200
@@ -0,0 +1,36 @@
+From: Alex Tutubalin <[email protected]>
+Date: Sat, 7 Mar 2026 18:40:05 +0300
+Subject: FP DNG data limit: perform calculations in 64 bit
+
+Origin: https://github.com/LibRaw/LibRaw/commit/dae685a198309b978805f098bafe5d951dbc8747
+Bug: https://talosintelligence.com/vulnerability_reports/TALOS-2026-2364
+Bug-Debian: https://bugs.debian.org/1133845
+Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2026-20884
+---
+ src/decoders/fp_dng.cpp | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+diff --git a/src/decoders/fp_dng.cpp b/src/decoders/fp_dng.cpp
+index 6f82e89..b18ca33 100644
+--- a/src/decoders/fp_dng.cpp
++++ b/src/decoders/fp_dng.cpp
+@@ -376,12 +376,15 @@ void LibRaw::deflate_dng_load_raw()
+ break;
+ }
+
+- unsigned tilePixels = tiles.tileWidth * tiles.tileHeight;
++ INT64 tilePixels = INT64(tiles.tileWidth) * INT64(tiles.tileHeight);
+ unsigned pixelSize = sizeof(float) * ifd->samples;
+- unsigned tileBytes = tilePixels * pixelSize;
+- unsigned tileRowBytes = tiles.tileWidth * pixelSize;
++ INT64 tileBytes = tilePixels * INT64(pixelSize);
++ INT64 tileRowBytes = INT64(tiles.tileWidth) * INT64(pixelSize);
+
+- if(INT64(tiles.maxBytesInTile) > INT64(imgdata.rawparams.max_raw_memory_mb) * INT64(1024 * 1024) )
++ if(INT64(tiles.maxBytesInTile) > INT64(imgdata.rawparams.max_raw_memory_mb) * 1024LL * 1024LL )
++ throw LIBRAW_EXCEPTION_TOOBIG;
++
++ if (tileBytes + tileRowBytes > INT64(imgdata.rawparams.max_raw_memory_mb) * 1024LL * 1024LL)
+ throw LIBRAW_EXCEPTION_TOOBIG;
+
+ std::vector<uchar> cBuffer(tiles.maxBytesInTile,0);
diff -Nru libraw-0.21.4/debian/patches/CVE-2026-20884/03-aa4458eb5.patch libraw-0.21.4/debian/patches/CVE-2026-20884/03-aa4458eb5.patch
--- libraw-0.21.4/debian/patches/CVE-2026-20884/03-aa4458eb5.patch 1970-01-01 01:00:00.000000000 +0100
+++ libraw-0.21.4/debian/patches/CVE-2026-20884/03-aa4458eb5.patch 2026-07-29 03:53:35.000000000 +0200
@@ -0,0 +1,61 @@
+From: Alex Tutubalin <[email protected]>
+Date: Fri, 13 Mar 2026 17:43:47 +0300
+Subject: Fix for data size calculation integer overflow in float/deflated DNG
+ loader (TALOS-2026-2364); Check for read results
+
+Origin: https://github.com/LibRaw/LibRaw/commit/aa4458eb511daeae90676c1ce5c587106e4aaec1
+Bug: https://talosintelligence.com/vulnerability_reports/TALOS-2026-2364
+Bug-Debian: https://bugs.debian.org/1133845
+Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2026-20884
+---
+ src/decoders/fp_dng.cpp | 26 +++++++++++++++++++++-----
+ 1 file changed, 21 insertions(+), 5 deletions(-)
+
+diff --git a/src/decoders/fp_dng.cpp b/src/decoders/fp_dng.cpp
+index b18ca33..c460373 100644
+--- a/src/decoders/fp_dng.cpp
++++ b/src/decoders/fp_dng.cpp
+@@ -349,14 +349,28 @@ void LibRaw::deflate_dng_load_raw()
+ tiles.init(ifd, imgdata.sizes, libraw_internal_data.unpacker_data, libraw_internal_data.unpacker_data.order,
+ libraw_internal_data.internal_data.input);
+
++ if (tiles.tBytes.size() < 1)
++ throw LIBRAW_EXCEPTION_IO_CORRUPT;
++
++ // Ensure less then 2GB per compressed tile
++ INT64 maxcomprlen = tiles.tBytes[0];
++ for (int i = 1; i < tiles.tBytes.size(); i++)
++ maxcomprlen = MAX(maxcomprlen, tiles.tBytes[i]);
++
++ if(maxcomprlen >= (1LL << 31) || maxcomprlen < 0)
++ throw LIBRAW_EXCEPTION_TOOBIG;
++
++ // Max bytes: 2^16 raw width * 2^2 bytes/pixel * 2^2 channels = 2^20, so check against 2^22
++ INT64 rowbytes = INT64(MAX(tiles.tileWidth, imgdata.sizes.raw_width)) * 4ULL * INT64(ifd->samples);
++ if (rowbytes > (1LL << 22))
++ throw LIBRAW_EXCEPTION_TOOBIG;
++
+ if (ifd->sample_format == 3)
+ {
+- INT64 raw_bytes = tiles.tileCnt * tiles.tileWidth * tiles.tileHeight * ifd->samples * sizeof(float);
++ INT64 raw_bytes = INT64(tiles.tileCnt) * INT64(tiles.tileWidth) * INT64(tiles.tileHeight) * INT64(ifd->samples) * sizeof(float);
+ if (raw_bytes > INT64(imgdata.rawparams.max_raw_memory_mb) * INT64(1024 * 1024))
+ throw LIBRAW_EXCEPTION_TOOBIG;
+- float_raw_image = (float *)calloc(tiles.tileCnt * tiles.tileWidth * tiles.tileHeight * ifd->samples, sizeof(float));
+- if (!float_raw_image)
+- throw LIBRAW_EXCEPTION_ALLOC;
++ float_raw_image = (float *)calloc(raw_bytes, 1);
+ }
+ else
+ throw LIBRAW_EXCEPTION_DECODE_RAW; // Only float deflated supported
+@@ -395,7 +409,9 @@ void LibRaw::deflate_dng_load_raw()
+ for (size_t x = 0; x < imgdata.sizes.raw_width; x += tiles.tileWidth, ++t)
+ {
+ libraw_internal_data.internal_data.input->seek(tiles.tOffsets[t], SEEK_SET);
+- libraw_internal_data.internal_data.input->read(cBuffer.data(), 1, tiles.tBytes[t]);
++ int bytesread = libraw_internal_data.internal_data.input->read(cBuffer.data(), 1, tiles.tBytes[t]);
++ if (bytesread < tiles.tBytes[t])
++ derror();
+ unsigned long dstLen = tileBytes;
+ int err =
+ uncompress(uBuffer.data() + tileRowBytes, &dstLen, cBuffer.data(), (unsigned long)tiles.tBytes[t]);
diff -Nru libraw-0.21.4/debian/patches/CVE-2026-20889.patch libraw-0.21.4/debian/patches/CVE-2026-20889.patch
--- libraw-0.21.4/debian/patches/CVE-2026-20889.patch 1970-01-01 01:00:00.000000000 +0100
+++ libraw-0.21.4/debian/patches/CVE-2026-20889.patch 2026-07-29 03:53:35.000000000 +0200
@@ -0,0 +1,96 @@
+From: Alex Tutubalin <[email protected]>
+Date: Sun, 1 Mar 2026 19:54:16 +0300
+Subject: Fix for TALOS-2026-2358
+
+Origin: https://github.com/LibRaw/LibRaw/commit/b9809e410d07ca7bf408e6d036615fb34f8c47cc
+Bug: https://talosintelligence.com/vulnerability_reports/TALOS-2026-2358
+Bug-Debian: https://bugs.debian.org/1133845
+Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2026-20889
+---
+ src/decoders/unpack_thumb.cpp | 2 ++
+ src/x3f/x3f_parse_process.cpp | 20 ++++++++++++++++++--
+ src/x3f/x3f_utils_patched.cpp | 7 +++++++
+ 3 files changed, 27 insertions(+), 2 deletions(-)
+
+diff --git a/src/decoders/unpack_thumb.cpp b/src/decoders/unpack_thumb.cpp
+index df30da1..f79b0bb 100644
+--- a/src/decoders/unpack_thumb.cpp
++++ b/src/decoders/unpack_thumb.cpp
+@@ -387,6 +387,8 @@ int LibRaw::unpack_thumb(void)
+ {
+ x3f_thumb_loader();
+ SET_PROC_FLAG(LIBRAW_PROGRESS_THUMB_LOAD);
++ if (!T.twidth && !T.theight)
++ return LIBRAW_NO_THUMBNAIL;
+ return 0;
+ }
+ #endif
+diff --git a/src/x3f/x3f_parse_process.cpp b/src/x3f/x3f_parse_process.cpp
+index 354e467..9742c8e 100644
+--- a/src/x3f/x3f_parse_process.cpp
++++ b/src/x3f/x3f_parse_process.cpp
+@@ -322,6 +322,7 @@ void LibRaw::x3f_thumb_loader()
+ {
+ try
+ {
++ INT64 checked_size = x3f_thumb_size(); // This value was checked at upper level?
+ x3f_t *x3f = (x3f_t *)_x3f_data;
+ if (!x3f)
+ return; // No data pointer set
+@@ -339,12 +340,24 @@ void LibRaw::x3f_thumb_loader()
+ imgdata.thumbnail.tcolors = 3;
+ if (imgdata.thumbnail.tformat == LIBRAW_THUMBNAIL_JPEG)
+ {
+- imgdata.thumbnail.thumb = (char *)malloc(ID->data_size);
++ INT64 alloc_size = ID->data_size;
++ if ((alloc_size > 2 * checked_size) || (alloc_size > 1024LL * 1024LL * LIBRAW_MAX_THUMBNAIL_MB))
++ throw LIBRAW_EXCEPTION_TOOBIG;
++ if(alloc_size < 64LL)
++ throw LIBRAW_EXCEPTION_IO_CORRUPT;
++
++ imgdata.thumbnail.thumb = (char *)malloc(ID->data_size);
+ memmove(imgdata.thumbnail.thumb, ID->data, ID->data_size);
+ imgdata.thumbnail.tlength = ID->data_size;
+ }
+ else if (imgdata.thumbnail.tformat == LIBRAW_THUMBNAIL_BITMAP)
+ {
++ INT64 alloc_size = INT64(ID->columns) * INT64(ID->rows) * 3LL;
++ if ((alloc_size > 2 * checked_size) ||
++ (alloc_size > 1024LL * 1024LL * LIBRAW_MAX_THUMBNAIL_MB)) throw LIBRAW_EXCEPTION_TOOBIG;
++ if (alloc_size < 64LL)
++ throw LIBRAW_EXCEPTION_IO_CORRUPT;
++
+ imgdata.thumbnail.tlength = ID->columns * ID->rows * 3;
+ imgdata.thumbnail.thumb = (char *)malloc(ID->columns * ID->rows * 3);
+ char *src0 = (char *)ID->data;
+@@ -361,7 +374,10 @@ void LibRaw::x3f_thumb_loader()
+ }
+ catch (...)
+ {
+- // do nothing
++ // no rethrow: handled at upper level
++ imgdata.thumbnail.twidth = 0;
++ imgdata.thumbnail.theight = 0;
++ imgdata.thumbnail.tcolors = 0;
+ }
+ }
+
+diff --git a/src/x3f/x3f_utils_patched.cpp b/src/x3f/x3f_utils_patched.cpp
+index 6b20b90..21c7ab1 100644
+--- a/src/x3f/x3f_utils_patched.cpp
++++ b/src/x3f/x3f_utils_patched.cpp
+@@ -1221,7 +1221,14 @@ static uint32_t read_data_block(void **data, x3f_info_t *I,
+ if (fpos + size > I->input.file->size())
+ throw LIBRAW_EXCEPTION_IO_CORRUPT;
+
++ // All known files from real cameras are many times smaller than 1 GB, so the hard limit is OK here.
++
++ if(size > 1024*1024*1024)
++ throw LIBRAW_EXCEPTION_ALLOC;
++
+ *data = (void *)malloc(size);
++ if (!*data)
++ throw LIBRAW_EXCEPTION_ALLOC;
+
+ GETN(*data, size);
+
diff -Nru libraw-0.21.4/debian/patches/CVE-2026-21413.patch libraw-0.21.4/debian/patches/CVE-2026-21413.patch
--- libraw-0.21.4/debian/patches/CVE-2026-21413.patch 1970-01-01 01:00:00.000000000 +0100
+++ libraw-0.21.4/debian/patches/CVE-2026-21413.patch 2026-07-29 03:53:35.000000000 +0200
@@ -0,0 +1,33 @@
+From: Alex Tutubalin <[email protected]>
+Date: Sat, 28 Feb 2026 18:26:53 +0300
+Subject: Fix for TALOS-2026-2331
+
+Origin: https://github.com/LibRaw/LibRaw/commit/75ed2c12a35b765b3b6ad695cc1f044f19efe644
+Bug: https://talosintelligence.com/vulnerability_reports/TALOS-2026-2331
+Bug-Debian: https://bugs.debian.org/1133845
+Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2026-21413
+---
+ src/decoders/decoders_dcraw.cpp | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/src/decoders/decoders_dcraw.cpp b/src/decoders/decoders_dcraw.cpp
+index 183136b..fc73e6c 100644
+--- a/src/decoders/decoders_dcraw.cpp
++++ b/src/decoders/decoders_dcraw.cpp
+@@ -560,6 +560,7 @@ void LibRaw::lossless_jpeg_load_raw()
+ if (jh.clrs == 4 && jwide >= raw_width * 2)
+ jhigh *= 2;
+
++
+ try
+ {
+ for (jrow = 0; jrow < jh.high; jrow++)
+@@ -588,7 +589,7 @@ void LibRaw::lossless_jpeg_load_raw()
+ col += (row--, raw_width);
+ if (row > raw_height)
+ throw LIBRAW_EXCEPTION_IO_CORRUPT;
+- if ((unsigned)row < raw_height)
++ if (((unsigned)row < raw_height) && ((unsigned)col < raw_width))
+ RAW(row, col) = val;
+ if (++col >= raw_width)
+ col = (row++, 0);
diff -Nru libraw-0.21.4/debian/patches/CVE-2026-24450.patch libraw-0.21.4/debian/patches/CVE-2026-24450.patch
--- libraw-0.21.4/debian/patches/CVE-2026-24450.patch 1970-01-01 01:00:00.000000000 +0100
+++ libraw-0.21.4/debian/patches/CVE-2026-24450.patch 2026-07-29 03:53:35.000000000 +0200
@@ -0,0 +1,55 @@
+From: Alex Tutubalin <[email protected]>
+Date: Thu, 12 Mar 2026 20:34:53 +0300
+Subject: Fix for TALOS-2026-2363: avoid integer overflow in allocation size
+ calculation. Also: check for EOF in read loop
+
+Origin: https://github.com/LibRaw/LibRaw/commit/c911c9b9edffa5fab99f828d0fee6dd2d0f6105f
+Bug: https://talosintelligence.com/vulnerability_reports/TALOS-2026-2363
+Bug-Debian: https://bugs.debian.org/1133845
+Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2026-24450
+---
+ src/decoders/fp_dng.cpp | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/src/decoders/fp_dng.cpp b/src/decoders/fp_dng.cpp
+index df7fe6c..4bb8f42 100644
+--- a/src/decoders/fp_dng.cpp
++++ b/src/decoders/fp_dng.cpp
+@@ -611,12 +611,17 @@ void LibRaw::uncompressed_fp_dng_load_raw()
+ tiles.init(ifd, imgdata.sizes, libraw_internal_data.unpacker_data, libraw_internal_data.unpacker_data.order,
+ libraw_internal_data.internal_data.input);
+
++ // Max bytes: 2^16 raw width * 2^2 bytes/pixel * 2^2 channels = 2^20, so check against 2^22
++ INT64 rowbytes = INT64(MAX(tiles.tileWidth, imgdata.sizes.raw_width)) * INT64(MAX(bytesps,4)) * INT64(ifd->samples);
++ if(rowbytes > (1LL << 22))
++ throw LIBRAW_EXCEPTION_TOOBIG;
++
+ INT64 allocsz = INT64(tiles.tileCnt) * INT64(tiles.tileWidth) * INT64(tiles.tileHeight) * INT64(ifd->samples) * INT64(sizeof(float));
+ if (allocsz > INT64(imgdata.rawparams.max_raw_memory_mb) * INT64(1024 * 1024))
+ throw LIBRAW_EXCEPTION_TOOBIG;
+
+ if (ifd->sample_format == 3)
+- float_raw_image = (float *)calloc(tiles.tileCnt * tiles.tileWidth * tiles.tileHeight *ifd->samples, sizeof(float));
++ float_raw_image = (float *)calloc(allocsz,1);
+ else
+ throw LIBRAW_EXCEPTION_DECODE_RAW; // Only float supported
+
+@@ -633,6 +638,7 @@ void LibRaw::uncompressed_fp_dng_load_raw()
+ size_t rowsInTile = y + tiles.tileHeight > imgdata.sizes.raw_height ? imgdata.sizes.raw_height - y : tiles.tileHeight;
+ size_t colsInTile = x + tiles.tileWidth > imgdata.sizes.raw_width ? imgdata.sizes.raw_width - x : tiles.tileWidth;
+
++ // inrowbytes is less then 2^22 (see above) so conversion to int is safe
+ size_t inrowbytes = colsInTile * bytesps * ifd->samples;
+ int fullrowbytes = tiles.tileWidth *bytesps * ifd->samples;
+ size_t outrowbytes = colsInTile * sizeof(float) * ifd->samples;
+@@ -642,7 +648,9 @@ void LibRaw::uncompressed_fp_dng_load_raw()
+ unsigned char *dst = fullrowbytes > inrowbytes ? rowbuf.data(): // last tile in row, use buffer
+ (unsigned char *)&float_raw_image
+ [((y + row) * imgdata.sizes.raw_width + x) * ifd->samples];
+- libraw_internal_data.internal_data.input->read(dst, 1, fullrowbytes);
++ int bytesread = libraw_internal_data.internal_data.input->read(dst, 1, fullrowbytes);
++ if (bytesread < fullrowbytes)
++ derror();
+ if (bytesps == 2 && difford)
+ libraw_swab(dst, fullrowbytes);
+ else if (bytesps == 3 && (libraw_internal_data.unpacker_data.order == 0x4949)) // II-16bit
diff -Nru libraw-0.21.4/debian/patches/CVE-2026-24660.patch libraw-0.21.4/debian/patches/CVE-2026-24660.patch
--- libraw-0.21.4/debian/patches/CVE-2026-24660.patch 1970-01-01 01:00:00.000000000 +0100
+++ libraw-0.21.4/debian/patches/CVE-2026-24660.patch 2026-07-29 03:53:35.000000000 +0200
@@ -0,0 +1,335 @@
+From: Alex Tutubalin <[email protected]>
+Date: Wed, 11 Mar 2026 11:57:24 +0300
+Subject: X3F decoder: implemented hard single allocation limit via
+ LIBRAW_X3F_ALLOC_LIMIT_MB define;
+ allocation size calculation converted to 64 bit arithm;
+ fix for TALOS-2026-2359
+
+Origin: https://github.com/LibRaw/LibRaw/commit/ac151a829b8d3e4c74fa3aefa8a029c3cc3f857f
+Bug: https://talosintelligence.com/vulnerability_reports/TALOS-2026-2359
+Bug-Debian: https://bugs.debian.org/1133845
+Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2026-24660
+---
+ libraw/libraw_const.h | 4 ++
+ src/x3f/x3f_utils_patched.cpp | 104 +++++++++++++++++++++++++-----------------
+ 2 files changed, 67 insertions(+), 41 deletions(-)
+
+diff --git a/libraw/libraw_const.h b/libraw/libraw_const.h
+index 61f8028..1e32fdf 100644
+--- a/libraw/libraw_const.h
++++ b/libraw/libraw_const.h
+@@ -55,6 +55,10 @@ it under the terms of the one of two licenses as you choose:
+ #endif
+
+
++/* max data size for known foveon cameras: 30mpix * 3 channels * 2 bytes = 180Mb, so 512Mb is OK for everything until/if new cameras will arrive */
++#ifndef LIBRAW_X3F_ALLOC_LIMIT_MB
++#define LIBRAW_X3F_ALLOC_LIMIT_MB 512ULL
++#endif
+
+ /* LibRaw uses own memory pool management, with LIBRAW_MSIZE (512)
+ entries. It is enough for parsing/decoding non-damaged files, but
+diff --git a/src/x3f/x3f_utils_patched.cpp b/src/x3f/x3f_utils_patched.cpp
+index 21c7ab1..fb1ecc1 100644
+--- a/src/x3f/x3f_utils_patched.cpp
++++ b/src/x3f/x3f_utils_patched.cpp
+@@ -50,6 +50,37 @@ BSD-style License
+ /* Reading and writing - assuming little endian in the file */
+ /* --------------------------------------------------------------------- */
+
++static void *x3f_limited_malloc(UINT64 sz)
++{
++ if (sz > LIBRAW_X3F_ALLOC_LIMIT_MB * 1024ULL * 1024ULL)
++ throw LIBRAW_EXCEPTION_TOOBIG;
++ void *ret = malloc(sz);
++ if (!ret)
++ throw LIBRAW_EXCEPTION_ALLOC;
++ return ret;
++}
++
++static void *x3f_limited_calloc(UINT64 n, UINT64 sz)
++{
++ if (sz * n > LIBRAW_X3F_ALLOC_LIMIT_MB * 1024ULL * 1024ULL)
++ throw LIBRAW_EXCEPTION_TOOBIG;
++ void *ret = calloc(n, sz);
++ if (!ret)
++ throw LIBRAW_EXCEPTION_ALLOC;
++ return ret;
++}
++
++static void *x3f_limited_realloc(void *ptr, UINT64 sz)
++{
++ if (sz > LIBRAW_X3F_ALLOC_LIMIT_MB * 1024ULL * 1024ULL)
++ throw LIBRAW_EXCEPTION_TOOBIG;
++ void *ret = realloc(ptr, sz);
++ if (!ret)
++ throw LIBRAW_EXCEPTION_ALLOC;
++ return ret;
++}
++
++
+ static int x3f_get1(LibRaw_abstract_datastream *f)
+ {
+ /* Little endian file */
+@@ -134,7 +165,7 @@ unsigned x3f_get4(LibRaw_abstract_datastream *f)
+ int _i; \
+ (_T).size = (_NUM); \
+ (_T).element = \
+- (_TYPE *)realloc((_T).element, (_NUM) * sizeof((_T).element[0])); \
++ (_TYPE *)x3f_limited_realloc((_T).element, (_NUM) * sizeof((_T).element[0])); \
+ for (_i = 0; _i < (int)(_T).size; _i++) \
+ _GETX((_T).element[_i]); \
+ } while (0)
+@@ -144,7 +175,7 @@ unsigned x3f_get4(LibRaw_abstract_datastream *f)
+ { \
+ int _i; \
+ (_T).size = (_NUM); \
+- (_T).element = (x3f_property_t *)realloc( \
++ (_T).element = (x3f_property_t *)x3f_limited_realloc( \
+ (_T).element, (_NUM) * sizeof((_T).element[0])); \
+ for (_i = 0; _i < (int)(_T).size; _i++) \
+ { \
+@@ -161,7 +192,7 @@ unsigned x3f_get4(LibRaw_abstract_datastream *f)
+ for (_i = 0;; _i++) \
+ { \
+ (_T).size = _i + 1; \
+- (_T).element = (x3f_true_huffman_element_t *)realloc( \
++ (_T).element = (x3f_true_huffman_element_t *)x3f_limited_realloc( \
+ (_T).element, (_i + 1) * sizeof((_T).element[0])); \
+ GET1((_T).element[_i].code_size); \
+ GET1((_T).element[_i].code); \
+@@ -182,7 +213,7 @@ static void new_huffman_tree(x3f_hufftree_t *HTP, int bits)
+
+ HTP->free_node_index = 0;
+ HTP->total_node_index = HUF_TREE_MAX_NODES(leaves);
+- HTP->nodes = (x3f_huffnode_t *)calloc(1, HUF_TREE_MAX_NODES(leaves) *
++ HTP->nodes = (x3f_huffnode_t *)x3f_limited_calloc(1, HUF_TREE_MAX_NODES(leaves) *
+ sizeof(x3f_huffnode_t));
+ }
+
+@@ -209,7 +240,7 @@ static void cleanup_true(x3f_true_t **TRUP)
+
+ static x3f_true_t *new_true(x3f_true_t **TRUP)
+ {
+- x3f_true_t *TRU = (x3f_true_t *)calloc(1, sizeof(x3f_true_t));
++ x3f_true_t *TRU = (x3f_true_t *)x3f_limited_calloc(1, sizeof(x3f_true_t));
+
+ cleanup_true(TRUP);
+
+@@ -241,7 +272,7 @@ static void cleanup_quattro(x3f_quattro_t **QP)
+
+ static x3f_quattro_t *new_quattro(x3f_quattro_t **QP)
+ {
+- x3f_quattro_t *Q = (x3f_quattro_t *)calloc(1, sizeof(x3f_quattro_t));
++ x3f_quattro_t *Q = (x3f_quattro_t *)x3f_limited_calloc(1, sizeof(x3f_quattro_t));
+ int i;
+
+ cleanup_quattro(QP);
+@@ -286,7 +317,7 @@ static void cleanup_huffman(x3f_huffman_t **HUFP)
+
+ static x3f_huffman_t *new_huffman(x3f_huffman_t **HUFP)
+ {
+- x3f_huffman_t *HUF = (x3f_huffman_t *)calloc(1, sizeof(x3f_huffman_t));
++ x3f_huffman_t *HUF = (x3f_huffman_t *)x3f_limited_calloc(1, sizeof(x3f_huffman_t));
+
+ cleanup_huffman(HUFP);
+
+@@ -317,9 +348,7 @@ static x3f_huffman_t *new_huffman(x3f_huffman_t **HUFP)
+ if (!infile)
+ return NULL;
+ INT64 fsize = infile->size();
+- x3f_t *x3f = (x3f_t *)calloc(1, sizeof(x3f_t));
+- if (!x3f)
+- throw LIBRAW_EXCEPTION_ALLOC;
++ x3f_t *x3f = (x3f_t *)x3f_limited_calloc(1, sizeof(x3f_t));
+ try
+ {
+ x3f_info_t *I = NULL;
+@@ -383,7 +412,7 @@ static x3f_huffman_t *new_huffman(x3f_huffman_t **HUFP)
+ if (DS->num_directory_entries > 0)
+ {
+ size_t size = DS->num_directory_entries * sizeof(x3f_directory_entry_t);
+- DS->directory_entry = (x3f_directory_entry_t *)calloc(1, size);
++ DS->directory_entry = (x3f_directory_entry_t *)x3f_limited_calloc(1, size);
+ }
+
+ /* Traverse the directory */
+@@ -1220,15 +1249,8 @@ static uint32_t read_data_block(void **data, x3f_info_t *I,
+
+ if (fpos + size > I->input.file->size())
+ throw LIBRAW_EXCEPTION_IO_CORRUPT;
+-
+- // All known files from real cameras are many times smaller than 1 GB, so the hard limit is OK here.
+-
+- if(size > 1024*1024*1024)
+- throw LIBRAW_EXCEPTION_ALLOC;
+-
+- *data = (void *)malloc(size);
+- if (!*data)
+- throw LIBRAW_EXCEPTION_ALLOC;
++
++ *data = (void *)x3f_limited_malloc(size);
+
+ GETN(*data, size);
+
+@@ -1363,36 +1385,36 @@ static void x3f_load_true(x3f_info_t *I, x3f_directory_entry_t *DE)
+ uint32_t columns = Q->plane[0].columns;
+ uint32_t rows = Q->plane[0].rows;
+ uint32_t channels = 3;
+- uint32_t size = columns * rows * channels;
++ UINT64 size = UINT64(columns) * UINT64(rows) * UINT64(channels);
+
+ TRU->x3rgb16.columns = columns;
+ TRU->x3rgb16.rows = rows;
+ TRU->x3rgb16.channels = channels;
+ TRU->x3rgb16.row_stride = columns * channels;
+- TRU->x3rgb16.buf = malloc(sizeof(uint16_t) * size);
++ TRU->x3rgb16.buf = x3f_limited_malloc(sizeof(uint16_t) * size);
+ TRU->x3rgb16.data = (uint16_t *)TRU->x3rgb16.buf;
+
+ columns = Q->plane[2].columns;
+ rows = Q->plane[2].rows;
+ channels = 1;
+- size = columns * rows * channels;
++ size = UINT64(columns) * UINT64(rows) * UINT64(channels);
+
+ Q->top16.columns = columns;
+ Q->top16.rows = rows;
+ Q->top16.channels = channels;
+ Q->top16.row_stride = columns * channels;
+- Q->top16.buf = malloc(sizeof(uint16_t) * size);
++ Q->top16.buf = x3f_limited_malloc(sizeof(uint16_t) * size);
+ Q->top16.data = (uint16_t *)Q->top16.buf;
+ }
+ else
+ {
+- uint32_t size = ID->columns * ID->rows * 3;
++ UINT64 size = UINT64(ID->columns) * UINT64(ID->rows) * 3ULL;
+
+ TRU->x3rgb16.columns = ID->columns;
+ TRU->x3rgb16.rows = ID->rows;
+ TRU->x3rgb16.channels = 3;
+ TRU->x3rgb16.row_stride = ID->columns * 3;
+- TRU->x3rgb16.buf = malloc(sizeof(uint16_t) * size);
++ TRU->x3rgb16.buf = x3f_limited_malloc(sizeof(uint16_t) * size);
+ TRU->x3rgb16.data = (uint16_t *)TRU->x3rgb16.buf;
+ }
+
+@@ -1441,7 +1463,7 @@ static void x3f_load_huffman(x3f_info_t *I, x3f_directory_entry_t *DE, int bits,
+ x3f_directory_entry_header_t *DEH = &DE->header;
+ x3f_image_data_t *ID = &DEH->data_subsection.image_data;
+ x3f_huffman_t *HUF = new_huffman(&ID->huffman);
+- uint32_t size;
++ UINT64 size;
+
+ if (use_map_table)
+ {
+@@ -1454,21 +1476,21 @@ static void x3f_load_huffman(x3f_info_t *I, x3f_directory_entry_t *DE, int bits,
+ {
+ case X3F_IMAGE_RAW_HUFFMAN_X530:
+ case X3F_IMAGE_RAW_HUFFMAN_10BIT:
+- size = ID->columns * ID->rows * 3;
++ size = UINT64(ID->columns) * UINT64(ID->rows) * 3ULL;
+ HUF->x3rgb16.columns = ID->columns;
+ HUF->x3rgb16.rows = ID->rows;
+ HUF->x3rgb16.channels = 3;
+ HUF->x3rgb16.row_stride = ID->columns * 3;
+- HUF->x3rgb16.buf = malloc(sizeof(uint16_t) * size);
++ HUF->x3rgb16.buf = x3f_limited_malloc(sizeof(uint16_t) * size);
+ HUF->x3rgb16.data = (uint16_t *)HUF->x3rgb16.buf;
+ break;
+ case X3F_IMAGE_THUMB_HUFFMAN:
+- size = ID->columns * ID->rows * 3;
++ size = UINT64(ID->columns) * UINT64(ID->rows) * 3ULL;
+ HUF->rgb8.columns = ID->columns;
+ HUF->rgb8.rows = ID->rows;
+ HUF->rgb8.channels = 3;
+ HUF->rgb8.row_stride = ID->columns * 3;
+- HUF->rgb8.buf = malloc(sizeof(uint8_t) * size);
++ HUF->rgb8.buf = x3f_limited_malloc(sizeof(uint8_t) * size);
+ HUF->rgb8.data = (uint8_t *)HUF->rgb8.buf;
+ break;
+ default:
+@@ -1568,7 +1590,7 @@ static void x3f_load_camf_decode_type2(x3f_camf_t *CAMF)
+ int i;
+
+ CAMF->decoded_data_size = CAMF->data_size;
+- CAMF->decoded_data = malloc(CAMF->decoded_data_size);
++ CAMF->decoded_data = x3f_limited_malloc(CAMF->decoded_data_size);
+
+ for (i = 0; i < (int)CAMF->data_size; i++)
+ {
+@@ -1609,7 +1631,7 @@ static void camf_decode_type4(x3f_camf_t *CAMF)
+
+ CAMF->decoded_data_size = dst_size;
+
+- CAMF->decoded_data = malloc(CAMF->decoded_data_size);
++ CAMF->decoded_data = x3f_limited_malloc(CAMF->decoded_data_size);
+ memset(CAMF->decoded_data, 0, CAMF->decoded_data_size);
+
+ dst = (uint8_t *)CAMF->decoded_data;
+@@ -1688,7 +1710,7 @@ static void x3f_load_camf_decode_type4(x3f_camf_t *CAMF)
+ for (i = 0, p = (uint8_t *)CAMF->data; *p != 0; i++)
+ {
+ /* TODO: Is this too expensive ??*/
+- element = (x3f_true_huffman_element_t *)realloc(element,
++ element = (x3f_true_huffman_element_t *)x3f_limited_realloc(element,
+ (i + 1) * sizeof(*element));
+
+ element[i].code_size = *p++;
+@@ -1729,7 +1751,7 @@ static void camf_decode_type5(x3f_camf_t *CAMF)
+ int32_t i;
+
+ CAMF->decoded_data_size = CAMF->t5.decoded_data_size;
+- CAMF->decoded_data = malloc(CAMF->decoded_data_size);
++ CAMF->decoded_data = x3f_limited_malloc(CAMF->decoded_data_size);
+
+ dst = (uint8_t *)CAMF->decoded_data;
+
+@@ -1753,7 +1775,7 @@ static void x3f_load_camf_decode_type5(x3f_camf_t *CAMF)
+ for (i = 0, p = (uint8_t *)CAMF->data; *p != 0; i++)
+ {
+ /* TODO: Is this too expensive ??*/
+- element = (x3f_true_huffman_element_t *)realloc(element,
++ element = (x3f_true_huffman_element_t *)x3f_limited_realloc(element,
+ (i + 1) * sizeof(*element));
+
+ element[i].code_size = *p++;
+@@ -1796,8 +1818,8 @@ static void x3f_setup_camf_property_entry(camf_entry_t *entry)
+ uint32_t num = entry->property_num = *(uint32_t *)v;
+ uint32_t off = *(uint32_t *)(v + 4);
+
+- entry->property_name = (char **)malloc(num * sizeof(uint8_t *));
+- entry->property_value = (uint8_t **)malloc(num * sizeof(uint8_t *));
++ entry->property_name = (char **)x3f_limited_malloc(num * sizeof(uint8_t *));
++ entry->property_value = (uint8_t **)x3f_limited_malloc(num * sizeof(uint8_t *));
+
+ for (i = 0; i < (int)num; i++)
+ {
+@@ -1851,7 +1873,7 @@ static void get_matrix_copy(camf_entry_t *entry)
+ : sizeof(uint32_t)) *
+ elements;
+
+- entry->matrix_decoded = malloc(size);
++ entry->matrix_decoded = x3f_limited_malloc(size);
+
+ switch (element_size)
+ {
+@@ -1921,7 +1943,7 @@ static void x3f_setup_camf_matrix_entry(camf_entry_t *entry)
+ uint32_t dim = entry->matrix_dim = *(uint32_t *)(v + 4);
+ uint32_t off = entry->matrix_data_off = *(uint32_t *)(v + 8);
+ camf_dim_entry_t *dentry = entry->matrix_dim_entry =
+- (camf_dim_entry_t *)malloc(dim * sizeof(camf_dim_entry_t));
++ (camf_dim_entry_t *)x3f_limited_malloc(dim * sizeof(camf_dim_entry_t));
+
+ for (i = 0; i < (int)dim; i++)
+ {
+@@ -1972,7 +1994,7 @@ static void x3f_setup_camf_entries(x3f_camf_t *CAMF)
+ }
+
+ /* TODO: lots of realloc - may be inefficient */
+- entry = (camf_entry_t *)realloc(entry, (i + 1) * sizeof(camf_entry_t));
++ entry = (camf_entry_t *)x3f_limited_realloc(entry, (i + 1) * sizeof(camf_entry_t));
+
+ /* Pointer */
+ entry[i].entry = p;
diff -Nru libraw-0.21.4/debian/patches/CVE-2026-5342.patch libraw-0.21.4/debian/patches/CVE-2026-5342.patch
--- libraw-0.21.4/debian/patches/CVE-2026-5342.patch 1970-01-01 01:00:00.000000000 +0100
+++ libraw-0.21.4/debian/patches/CVE-2026-5342.patch 2026-07-29 03:53:35.000000000 +0200
@@ -0,0 +1,61 @@
+From: Alex Tutubalin <[email protected]>
+Date: Tue, 17 Mar 2026 12:44:57 +0300
+Subject: Nikon padded/12bit: no need to calculate padded row size before
+ final raw_width adjustment
+
+Origin: https://github.com/LibRaw/LibRaw/commit/2468614a9cbcab6b75ca279ab60cac62156f7aeb
+Bug: https://github.com/LibRaw/LibRaw/issues/795
+Bug-Debian: https://bugs.debian.org/1132655
+Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2026-5342
+---
+ src/decoders/decoders_libraw.cpp | 18 ++++++++++++------
+ src/metadata/tiff.cpp | 2 --
+ 2 files changed, 12 insertions(+), 8 deletions(-)
+
+diff --git a/src/decoders/decoders_libraw.cpp b/src/decoders/decoders_libraw.cpp
+index eb277c3..5a82352 100644
+--- a/src/decoders/decoders_libraw.cpp
++++ b/src/decoders/decoders_libraw.cpp
+@@ -259,17 +259,23 @@ void LibRaw::fuji_14bit_load_raw()
+ void LibRaw::nikon_load_padded_packed_raw() // 12 bit per pixel, padded to 16
+ // bytes
+ {
++ unsigned bytesperrow = (((unsigned(S.raw_width) * 3u / 2u) + 15u) / 16u) * 16u; // bytes per row
++
+ // libraw_internal_data.unpacker_data.load_flags -> row byte count
+- if (libraw_internal_data.unpacker_data.load_flags < 2000 ||
+- libraw_internal_data.unpacker_data.load_flags > 64000)
+- return;
++ if (bytesperrow < 2000 || bytesperrow > 64000)
++ throw LIBRAW_EXCEPTION_IO_CORRUPT;
++
+ unsigned char *buf =
+- (unsigned char *)calloc(libraw_internal_data.unpacker_data.load_flags,1);
++ (unsigned char *)calloc(bytesperrow,1);
+ for (int row = 0; row < S.raw_height; row++)
+ {
+ checkCancel();
+- libraw_internal_data.internal_data.input->read(
+- buf, libraw_internal_data.unpacker_data.load_flags, 1);
++ int readed = libraw_internal_data.internal_data.input->read(
++ buf, 1, bytesperrow);
++
++ if (readed < (int)bytesperrow)
++ derror();
++
+ for (int icol = 0; icol < S.raw_width / 2; icol++)
+ {
+ imgdata.rawdata.raw_image[(row)*S.raw_width + (icol * 2)] =
+diff --git a/src/metadata/tiff.cpp b/src/metadata/tiff.cpp
+index 5ec07a2..5ba41ae 100644
+--- a/src/metadata/tiff.cpp
++++ b/src/metadata/tiff.cpp
+@@ -2031,8 +2031,6 @@ void LibRaw::apply_tiff()
+ INT64(tiff_ifd[raw].bytes))
+ {
+ load_raw = &LibRaw::nikon_load_padded_packed_raw;
+- load_flags = (((INT64(raw_width) * 3ULL / 2ULL) + 15ULL) / 16ULL) *
+- 16ULL; // bytes per row
+ }
+ else if (!strncmp(model, "NIKON Z 9", 9) && tiff_ifd[raw].offset)
+ {
diff -Nru libraw-0.21.4/debian/patches/series libraw-0.21.4/debian/patches/series
--- libraw-0.21.4/debian/patches/series 1970-01-01 01:00:00.000000000 +0100
+++ libraw-0.21.4/debian/patches/series 2026-07-29 03:53:35.000000000 +0200
@@ -0,0 +1,8 @@
+CVE-2026-21413.patch
+CVE-2026-20889.patch
+CVE-2026-24660.patch
+CVE-2026-24450.patch
+CVE-2026-20884/01-afba34ec3.patch
+CVE-2026-20884/02-dae685a19.patch
+CVE-2026-20884/03-aa4458eb5.patch
+CVE-2026-5342.patch
diff -Nru libraw-0.21.4/debian/salsa-ci.yml libraw-0.21.4/debian/salsa-ci.yml
--- libraw-0.21.4/debian/salsa-ci.yml 1970-01-01 01:00:00.000000000 +0100
+++ libraw-0.21.4/debian/salsa-ci.yml 2026-07-29 03:53:35.000000000 +0200
@@ -0,0 +1,9 @@
+---
+include:
+ - https://salsa.debian.org/salsa-ci-team/pipeline/raw/master/recipes/debian.yml
+
+variables:
+ RELEASE: 'trixie'
+ SALSA_CI_DISABLE_LINTIAN: 1
+ SALSA_CI_DISABLE_REPROTEST: 1
+ SALSA_CI_DISABLE_USCAN: 1
signature.asc
Description: PGP signature
--- End Message ---
