starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2016-10130 (published 2017-03-24T15:59Z)

The http_connect function in transports/http.c in libgit2 before 0.24.6 and 0.25.x before 0.25.1 might allow man-in-the-middle attackers to spoof servers by leveraging clobbering of the error variable.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
CVSS v3 base score: 5.9, MEDIUM (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)

Weakness information:
cwe_id: CWE-284
cwe_name: Improper Access Control
description: The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
extended_description: 
            Access control involves the use of several protection mechanisms such as:
            
               Authentication (proving the identity of an actor)
               Authorization (ensuring that a given actor can access a resource), and
               Accountability (tracking of activities that were performed)
            
            When any mechanism is not applied or otherwise fails, attackers can compromise the security of the product by gaining privileges, reading sensitive information, executing commands, evading detection, etc.
            There are two distinct behaviors that can introduce access control weaknesses:
               
                  Specification: incorrect privileges, permissions, ownership, etc. are explicitly specified for either the user or the resource (for example, setting a password file to be world-writable, or giving administrator capabilities to a guest user). This action could be performed by the program or the administrator.
                  Enforcement: the mechanism contains errors that prevent it from properly enforcing the specified access control requirements (e.g., allowing the user to specify their own privileges, or allowing a syntactically-incorrect ACL to produce insecure settings). This problem occurs within the program itself, in that it does not actually enforce the intended security policy that the administrator specifies.
               
         
		 

Fix information:
repo_url: https://github.com/libgit2/libgit2
commit_details: repo_url: https://github.com/libgit2/libgit2
author: Etienne Samson
author_date: 2016-12-21 21:24:33+01:00
msg: http: check certificate validity before clobbering the error variable
repository: repo_url: https://github.com/libgit2/libgit2
repo_name: libgit2/libgit2
description: A cross-platform, linkable library implementation of Git that you can use in your application.
repo_language: C
owner: libgit2
file_changes: filename: http.c
change_type: ModificationType.MODIFY
diff: @@ -624,13 +624,12 @@ static int http_connect(http_subtransport *t)
 	if ((!error || error == GIT_ECERTIFICATE) && t->owner->certificate_check_cb != NULL &&
 	    git_stream_is_encrypted(t->io)) {
 		git_cert *cert;
-		int is_valid;
+		int is_valid = (error == GIT_OK);
 
 		if ((error = git_stream_certificate(&cert, t->io)) < 0)
 			return error;
 
 		giterr_clear();
-		is_valid = error != GIT_ECERTIFICATE;
 		error = t->owner->certificate_check_cb(cert, is_valid, t->connection_data.host, t->owner->message_cb_payload);
 
 		if (error < 0) {

programming_language: C
CVE-2016-7525 (published 2017-04-20T18:59Z)

Heap-based buffer overflow in coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PSD file.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/ImageMagick/ImageMagick
commit_details: repo_url: https://github.com/ImageMagick/ImageMagick
author: dirk
author_date: 2016-02-06 12:26:49+01:00
msg: Fixed head buffer overflow reported in: https://github.com/ImageMagick/ImageMagick/issues/98
repository: repo_url: https://github.com/ImageMagick/ImageMagick
repo_name: ImageMagick/ImageMagick
description: 🧙‍♂️ ImageMagick 7
repo_language: C
owner: ImageMagick
file_changes: filename: psd.c
change_type: ModificationType.MODIFY
diff: @@ -575,7 +575,7 @@ static inline MagickSizeType GetPSDSize(const PSDInfo *psd_info,Image *image)
 static inline size_t GetPSDRowSize(Image *image)
 {
   if (image->depth == 1)
-    return((image->columns+7)/8);
+    return(((image->columns+7)/8)*GetPSDPacketSize(image));
   else
     return(image->columns*GetPSDPacketSize(image));
 }

programming_language: Objective-C
CVE-2023-3212 (published 2023-06-23T20:15Z)

A NULL pointer dereference issue was found in the gfs2 file system in the Linux kernel. It occurs on corrupt gfs2 file systems when the evict code tries to reference the journal descriptor structure after it has been freed and set to NULL. A privileged local user could use this flaw to cause a kernel panic.

CVSS v3 base score: 4.4, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Bob Peterson
author_date: 2023-04-28 12:07:46-04:00
msg: gfs2: Don't deref jdesc in evict

On corrupt gfs2 file systems the evict code can try to reference the
journal descriptor structure, jdesc, after it has been freed and set to
NULL. The sequence of events is:

init_journal()
...
fail_jindex:
   gfs2_jindex_free(sdp); <------frees journals, sets jdesc = NULL
      if (gfs2_holder_initialized(&ji_gh))
         gfs2_glock_dq_uninit(&ji_gh);
fail:
   iput(sdp->sd_jindex); <--references jdesc in evict_linked_inode
      evict()
         gfs2_evict_inode()
            evict_linked_inode()
               ret = gfs2_trans_begin(sdp, 0, sdp->sd_jdesc->jd_blocks);
<------references the now freed/zeroed sd_jdesc pointer.

The call to gfs2_trans_begin is done because the truncate_inode_pages
call can cause gfs2 events that require a transaction, such as removing
journaled data (jdata) blocks from the journal.

This patch fixes the problem by adding a check for sdp->sd_jdesc to
function gfs2_evict_inode. In theory, this should only happen to corrupt
gfs2 file systems, when gfs2 detects the problem, reports it, then tries
to evict all the system inodes it has read in up to that point.

Reported-by: Yang Lan <lanyang0908@gmail.com>
Signed-off-by: Bob Peterson <rpeterso@redhat.com>
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: super.c
change_type: ModificationType.MODIFY
diff: @@ -1419,6 +1419,14 @@ static void gfs2_evict_inode(struct inode *inode)
 	if (inode->i_nlink || sb_rdonly(sb) || !ip->i_no_addr)
 		goto out;
 
+	/*
+	 * In case of an incomplete mount, gfs2_evict_inode() may be called for
+	 * system files without having an active journal to write to.  In that
+	 * case, skip the filesystem evict.
+	 */
+	if (!sdp->sd_jdesc)
+		goto out;
+
 	gfs2_holder_mark_uninitialized(&gh);
 	ret = evict_should_delete(inode, &gh);
 	if (ret == SHOULD_DEFER_EVICTION)

programming_language: C
CVE-2012-1123 (published 2012-06-29T19:55Z)

The mci_check_login function in api/soap/mc_api.php in the SOAP API in MantisBT before 1.2.9 allows remote attackers to bypass authentication via a null password.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)

Weakness information:
cwe_id: CWE-287
cwe_name: Improper Authentication
description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
extended_description: 
            
			
         
         

Fix information:
repo_url: https://github.com/mantisbt/mantisbt
commit_details: repo_url: https://github.com/mantisbt/mantisbt
author: root
author_date: 2012-02-16 09:41:56+00:00
msg: Fix 0013901: SOAP API allows invoking methods without proper authentication

Note: only applied to 1.2.x not 'next', as the code is changing anyway
repository: repo_url: https://github.com/mantisbt/mantisbt
repo_name: mantisbt/mantisbt
description: Mantis Bug Tracker (MantisBT)
repo_language: PHP
owner: mantisbt
file_changes: filename: mc_api.php
change_type: ModificationType.MODIFY
diff: @@ -51,6 +51,11 @@ function mci_check_login( $p_username, $p_password ) {
 
 		# do not use password validation.
 		$p_password = null;
+	} else {
+		if( is_blank( $p_password ) ) {
+			# require password for authenticated access
+			return false;
+		}
 	}
 
 	if( false === auth_attempt_script_login( $p_username, $p_password ) ) {

programming_language: PHP
CVE-2023-0288 (published 2023-01-13T16:15Z)

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1189.

CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-122
cwe_name: Heap-based Buffer Overflow
description: A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/vim/vim
commit_details: repo_url: https://github.com/vim/vim
author: Bram Moolenaar
author_date: 2023-01-13 14:17:58+00:00
msg: patch 9.0.1189: invalid memory access with folding and using "L"

Problem:    Invalid memory access with folding and using "L".
Solution:   Prevent the cursor from moving to line zero.
repository: repo_url: https://github.com/vim/vim
repo_name: vim/vim
description: The official Vim repository
repo_language: Vim Script
owner: vim
file_changes: filename: normal.c
change_type: ModificationType.MODIFY
diff: @@ -3729,7 +3729,8 @@ nv_scroll(cmdarg_T *cap)
 		{
 		    (void)hasFolding(curwin->w_cursor.lnum,
 						&curwin->w_cursor.lnum, NULL);
-		    --curwin->w_cursor.lnum;
+		    if (curwin->w_cursor.lnum > curwin->w_topline)
+			--curwin->w_cursor.lnum;
 		}
 	    }
 	    else

programming_language: C
filename: test_fold.vim
change_type: ModificationType.MODIFY
diff: @@ -1675,4 +1675,12 @@ func Test_sort_closed_fold()
   bwipe!
 endfunc
 
+func Test_indent_with_L_command()
+  " The "L" command moved the cursor to line zero, causing the text saved for
+  " undo to use line number -1, which caused trouble for undo later.
+  new
+  sil! norm 8RV{zf8=Lu
+  bwipe!
+endfunc
+
 " vim: shiftwidth=2 sts=2 expandtab

programming_language: Lua
filename: version.c
change_type: ModificationType.MODIFY
diff: @@ -695,6 +695,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    1189,
 /**/
     1188,
 /**/

programming_language: Ruby
CVE-2020-10232 (published 2020-03-09T00:15Z)

In version 4.8.0 and earlier of The Sleuth Kit (TSK), there is a stack buffer overflow vulnerability in the YAFFS file timestamp parsing logic in yaffsfs_istat() in fs/yaffs.c.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/sleuthkit/sleuthkit
commit_details: repo_url: https://github.com/sleuthkit/sleuthkit
author: micrictor
author_date: 2020-02-22 12:17:25-08:00
msg: Fix stack buffer overflow in yaffsfs_istat

Prevent a stack buffer overflow in yaffsfs_istat by increasing the buffer size to the size required by tsk_fs_time_to_str.
repository: repo_url: https://github.com/sleuthkit/sleuthkit
repo_name: sleuthkit/sleuthkit
description: The Sleuth Kit® (TSK) is a library and collection of command line digital forensics tools that allow you to investigate volume and file system data. The library can be incorporated into larger digital forensics tools and the command line tools can be directly used to find evidence. 
repo_language: C
owner: sleuthkit
file_changes: filename: yaffs.cpp
change_type: ModificationType.MODIFY
diff: @@ -2439,7 +2439,7 @@ static uint8_t
     YAFFSFS_INFO *yfs = (YAFFSFS_INFO *)fs;
     char ls[12];
     YAFFSFS_PRINT_ADDR print;
-    char timeBuf[32];
+    char timeBuf[128];
     YaffsCacheObject * obj = NULL;
     YaffsCacheVersion * version = NULL;
     YaffsHeader * header = NULL;

programming_language: C
CVE-2019-20917 (published 2020-09-11T05:15Z)

An issue was discovered in InspIRCd 2 before 2.0.28 and 3 before 3.3.0. The mysql module contains a NULL pointer dereference when built against mariadb-connector-c 3.0.5 or newer. When combined with the sqlauth or sqloper modules, this vulnerability can be used for remote crashing of an InspIRCd server by any user able to connect to a server.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:L/Au:S/C:N/I:N/A:C)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/inspircd/inspircd
commit_details: repo_url: https://github.com/inspircd/inspircd
author: Peter Powell
author_date: 2019-08-20 16:17:18+01:00
msg: Initialise and deallocate the MySQL library correctly.
repository: repo_url: https://github.com/inspircd/inspircd
repo_name: inspircd/inspircd
description: A modular C++ IRC server (ircd).
repo_language: C++
owner: inspircd
file_changes: filename: m_mysql.cpp
change_type: ModificationType.MODIFY
diff: @@ -412,6 +412,9 @@ ModuleSQL::ModuleSQL()
 
 void ModuleSQL::init()
 {
+	if (mysql_library_init(0, NULL, NULL))
+		throw ModuleException("Unable to initialise the MySQL library!");
+
 	Dispatcher = new DispatcherThread(this);
 	ServerInstance->Threads.Start(Dispatcher);
 }
@@ -424,10 +427,13 @@ ModuleSQL::~ModuleSQL()
 		Dispatcher->OnNotify();
 		delete Dispatcher;
 	}
+
 	for(ConnMap::iterator i = connections.begin(); i != connections.end(); i++)
 	{
 		delete i->second;
 	}
+
+	mysql_library_end();
 }
 
 void ModuleSQL::ReadConfig(ConfigStatus& status)

programming_language: C++
CVE-2018-20750 (published 2019-01-30T18:29Z)

LibVNC through 0.9.12 contains a heap out-of-bounds write vulnerability in libvncserver/rfbserver.c. The fix for CVE-2018-15127 was incomplete.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/LibVNC/libvncserver
commit_details: repo_url: https://github.com/LibVNC/libvncserver
author: Petr Písař
author_date: 2019-01-07 10:40:01+01:00
msg: Limit lenght to INT_MAX bytes in rfbProcessFileTransferReadBuffer()

This ammends 15bb719c03cc70f14c36a843dcb16ed69b405707 fix for a heap
out-of-bound write access in rfbProcessFileTransferReadBuffer() when
reading a transfered file content in a server. The former fix did not
work on platforms with a 32-bit int type (expected by rfbReadExact()).

CVE-2018-15127
<https://github.com/LibVNC/libvncserver/issues/243>
<https://github.com/LibVNC/libvncserver/issues/273>
repository: repo_url: https://github.com/LibVNC/libvncserver
repo_name: LibVNC/libvncserver
description: LibVNCServer/LibVNCClient are cross-platform C libraries that allow you to easily implement VNC server or client functionality in your program.
repo_language: C
owner: LibVNC
file_changes: filename: rfbserver.c
change_type: ModificationType.MODIFY
diff: @@ -88,6 +88,8 @@
 #include <errno.h>
 /* strftime() */
 #include <time.h>
+/* INT_MAX */
+#include <limits.h>
 
 #ifdef LIBVNCSERVER_WITH_WEBSOCKETS
 #include "rfbssl.h"
@@ -1472,8 +1474,11 @@ char *rfbProcessFileTransferReadBuffer(rfbClientPtr cl, uint32_t length)
        0XFFFFFFFF, i.e. SIZE_MAX for 32-bit systems. On 64-bit systems, a length of 0XFFFFFFFF
        will safely be allocated since this check will never trigger and malloc() can digest length+1
        without problems as length is a uint32_t.
+       We also later pass length to rfbReadExact() that expects a signed int type and
+       that might wrap on platforms with a 32-bit int type if length is bigger
+       than 0X7FFFFFFF.
     */
-    if(length == SIZE_MAX) {
+    if(length == SIZE_MAX || length > INT_MAX) {
 	rfbErr("rfbProcessFileTransferReadBuffer: too big file transfer length requested: %u", (unsigned int)length);
 	rfbCloseClient(cl);
 	return NULL;

programming_language: C
CVE-2023-45197 (published 2024-06-21T15:15Z)

The file upload plugin in Adminer and AdminerEvo allows an attacker to upload a file with a table name of “..” to the root of the Adminer directory. The attacker can effectively guess the name of the uploaded file and execute it. Adminer is no longer supported, but this issue was fixed in AdminerEvo version 4.8.3.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-434
cwe_name: Unrestricted Upload of File with Dangerous Type
description: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
extended_description: 
            
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/adminerevo/adminerevo
commit_details: repo_url: https://github.com/adminerevo/adminerevo
author: Lionel Laffineur
author_date: 2023-10-17 22:19:17+02:00
msg: Plugin file-upload generate temp filename no extension + prevent file to be located elsewhere then under upload path
repository: repo_url: https://github.com/adminerevo/adminerevo
repo_name: adminerevo/adminerevo
description: Database management in a single PHP file
repo_language: PHP
owner: adminerevo
file_changes: filename: file-upload.php
change_type: ModificationType.MODIFY
diff: @@ -32,12 +32,22 @@ class AdminerFileUpload {
 		if (preg_match('~(.*)_path$~', $field["field"], $regs)) {
 			$table = ($_GET["edit"] != "" ? $_GET["edit"] : $_GET["select"]);
 			$name = "fields-$field[field]";
-			if ($_FILES[$name]["error"] || !preg_match("~(\\.($this->extensions))?\$~", $_FILES[$name]["name"], $regs2)) {
+			if ($_FILES["fields"]["error"][$field["field"]] || !preg_match("~(\\.($this->extensions))?\$~", $_FILES["fields"]["name"][$field["field"]], $regs2)) {
 				return false;
 			}
-			//! unlink old
-			$filename = uniqid() . $regs2[0];
-			if (!move_uploaded_file($_FILES[$name]["tmp_name"], "$this->uploadPath$table/$regs[1]-$filename")) {
+			// create sub-directory if needed
+			if (file_exists(__DIR__ . '/' . $this->uploadPath . '/' . $table) === false) {
+				mkdir(__DIR__ . '/' . $this->uploadPath . '/' . $table);
+			}
+			// generate filename
+			$filename = realpath(tempnam(__DIR__ . '/' . $this->uploadPath . '/' . $table, ''));
+			
+			// prevent the final to be anywhere else then under the upload directory
+			if (strpos($filename, realpath(__DIR__ . '/' . $this->uploadPath)) !== 0) {
+				return false;
+			}
+			// move file to its final location
+			if (!move_uploaded_file($_FILES["fields"]["tmp_name"][$field["field"]], $filename)) {
 				return false;
 			}
 			return q($filename);

programming_language: PHP
CVE-2022-0721 (published 2022-02-23T11:15Z)

Insertion of Sensitive Information Into Debugging Code in GitHub repository microweber/microweber prior to 1.3.

Severity: MEDIUM
CVSS v2 base score: 4.0 (AV:N/AC:L/Au:S/C:P/I:N/A:N)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/microweber/microweber
commit_details: repo_url: https://github.com/microweber/microweber
author: Bozhidar Slaveykov
author_date: 2022-02-22 12:35:12+02:00
msg: Update Handler.php
repository: repo_url: https://github.com/microweber/microweber
repo_name: microweber/microweber
description: Drag and Drop Website Builder and CMS with E-commerce
repo_language: HTML
owner: microweber
file_changes: filename: Handler.php
change_type: ModificationType.MODIFY
diff: @@ -12,9 +12,9 @@ class Handler extends ExceptionHandler
      *
      * @var array
      */
-//    protected $dontReport = [
-//        //
-//    ];
+    protected $dontReport = [
+        \BadMethodCallException::class,
+    ];
 
     /**
      * A list of the inputs that are never flashed for validation exceptions.
@@ -102,10 +102,10 @@ class Handler extends ExceptionHandler
                  <a href="' . api_url('mw_post_update') . '?redirect_to='.url_current().'" class="btn">Reload database</a>
                  <a href="' . api_url('mw_reload_modules') . '?redirect_to='.url_current().'" class="btn">Reload modules</a>
                  <a href="' . api_url('clearcache') . '?redirect_to='.url_current().'" class="btn">Clear cache</a>
-                 
+
                  <a href="" class="btn">Refresh</a>
             </div>
         </div>
         ';
     }
-}
\ No newline at end of file
+}

programming_language: PHP
CVE-2013-2126 (published 2013-08-14T15:55Z)

Multiple double free vulnerabilities in the LibRaw::unpack function in libraw_cxx.cpp in LibRaw before 0.15.2 allow context-dependent attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a malformed full-color (1) Foveon or (2) sRAW image file.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)

Weakness information:
cwe_id: CWE-399
cwe_name: Resource Management Errors
description: Weaknesses in this category are related to improper management of system resources.

Fix information:
repo_url: https://github.com/LibRaw/LibRaw
commit_details: repo_url: https://github.com/LibRaw/LibRaw
author: Alex Tutubalin
author_date: 2013-05-26 11:53:39+04:00
msg: prevent double-free() on broken full-color images error handling
repository: repo_url: https://github.com/LibRaw/LibRaw
repo_name: LibRaw/LibRaw
description: LibRaw is a library for reading RAW files from digital cameras
repo_language: C++
owner: LibRaw
file_changes: filename: libraw_cxx.cpp
change_type: ModificationType.MODIFY
diff: @@ -1144,8 +1144,8 @@ int LibRaw::unpack(void)
                 IO.shrink = 0;
 				S.raw_pitch = S.width*8;
                 // allocate image as temporary buffer, size 
-                imgdata.rawdata.raw_alloc = calloc(S.iwidth*S.iheight,sizeof(*imgdata.image));
-                imgdata.image = (ushort (*)[4]) imgdata.rawdata.raw_alloc;
+                imgdata.rawdata.raw_alloc = 0;
+                imgdata.image = (ushort (*)[4]) calloc(S.iwidth*S.iheight,sizeof(*imgdata.image));
               }
             ID.input->seek(libraw_internal_data.unpacker_data.data_offset, SEEK_SET);
 
@@ -1155,6 +1155,12 @@ int LibRaw::unpack(void)
             (this->*load_raw)();
 			if(load_raw == &LibRaw::unpacked_load_raw && !strcasecmp(imgdata.idata.make,"Nikon"))
 				C.maximum = m_save;
+			if (decoder_info.decoder_flags & LIBRAW_DECODER_LEGACY)
+			{
+				// successfully decoded legacy image, attach image to raw_alloc
+				imgdata.rawdata.raw_alloc = imgdata.image;
+				imgdata.image = 0; 
+			}
           }
 
         if(imgdata.rawdata.raw_image)

programming_language: C++