Skip to content

Round up the size of DNG packed buffer to avoid writing beyond the end

Created originally on Bitbucket by thenickdude (Nicholas Sherlock)

Changesets for this Pull Request have not been imported, because it had been already declined on Bitbucket. Marked as closed by the import user.

Fixes a segfault while writing DNGs:

Thread 2 received signal SIGSEGV, Segmentation fault.
dng_unpack_image_bits (input_buffer=0x10a2d5000, output_buffer=0x10c000000, max_size=<optimized out>,
    bpp=14) at dng/dng.c:739
739	        uint32_t uncorrected_data = *((uint32_t *)&packed_bits[bits_address]);

Valgrind output:

==17989== Invalid write of size 4
==17989==    at 0x100010313: dng_save (dng.c:772)
==17989==    by 0x10000932D: main (mlv_dump.c:3632)
==17989==  Address 0x10d11103e is 22,020,094 bytes inside a block of size 22,020,096 alloc'd
==17989==    at 0x100723A36: malloc (vg_replace_malloc.c:302)
==17989==    by 0x10000FD75: dng_init_data (dng.c:823)
==17989==    by 0x1000084C6: main (mlv_dump.c:3486)

Merge request reports