fix CVE-2015-3885 const correct. fix evaluation order. clang6 fixes: sufficient width for integers in static tables, and whitespace. Index: src/dcraw.cc --- src/dcraw.cc.orig +++ src/dcraw.cc @@ -916,7 +916,8 @@ struct jhead { int CLASS ljpeg_start (struct jhead *jh, int info_only) { - int c, tag, len; + int c, tag; + ushort len; uchar data[0x10000], *dp; if (!info_only) init_decoder(); @@ -2634,7 +2635,8 @@ void CLASS sony_decrypt (unsigned *data, int len, int pad[p] = htonl(pad[p]); } while (len--) - *data++ ^= pad[p++ & 127] = pad[(p+1) & 127] ^ pad[(p+65) & 127]; + *data++ ^= pad[p & 127] = pad[(p+1) & 127] ^ pad[(p+65) & 127]; + p++; } void CLASS sony_load_raw() @@ -4061,7 +4063,7 @@ void CLASS lin_interpolate() */ void CLASS vng_interpolate() { - static const signed char *cp, terms[] = { + static const signed short *cp, terms[] = { -2,-2,+0,-1,0,0x01, -2,-2,+0,+0,1,0x01, -2,-1,-1,+0,0,0x01, -2,-1,+0,-1,0,0x02, -2,-1,+0,+0,0,0x03, -2,-1,+0,+1,1,0x01, -2,+0,+0,-1,0,0x06, -2,+0,+0,+0,1,0x02, -2,+0,+0,+1,0,0x03, @@ -6174,7 +6176,8 @@ void CLASS adobe_coeff (const char *make, const char * { static const struct { const char *prefix; - short black, maximum, trans[12]; + ushort black, maximum; + short trans[12]; } table[] = { { "Apple QuickTake", 0, 0, /* DJC */ { 17576,-3191,-3318,5210,6733,-1942,9031,1280,-124 } }, @@ -6606,8 +6609,8 @@ void CLASS adobe_coeff (const char *make, const char * sprintf (name, "%s %s", make, model); for (i=0; i < (int) sizeof table / (int) sizeof *table; i++) if (!strncmp (name, table[i].prefix, strlen(table[i].prefix))) { - if (table[i].black) black = (ushort) table[i].black; - if (table[i].maximum) maximum = (ushort) table[i].maximum; + if (table[i].black) black = table[i].black; + if (table[i].maximum) maximum = table[i].maximum; for (j=0; j < 4; j++) for (k=0; k < 3; k++) cam_xyz[j][k] = table[i].trans[3*j+k] / 10000.0; @@ -8366,7 +8369,7 @@ void CLASS tiff_head (struct tiff_hdr *th, int full) strncpy (th->desc, desc, 512); strncpy (th->make, make, 64); strncpy (th->model, model, 64); - strcpy (th->soft, "dcraw v"DCRAW_VERSION); + strcpy (th->soft, "dcraw v" DCRAW_VERSION); t = gmtime (×tamp); sprintf (th->date, "%04d:%02d:%02d %02d:%02d:%02d", t->tm_year+1900,t->tm_mon+1,t->tm_mday,t->tm_hour,t->tm_min,t->tm_sec); @@ -8445,7 +8448,8 @@ int CLASS main (int argc, const char **argv) static int timestamp_only=0, thumbnail_only=0, identify_only=0; static int user_qual=-1, user_black=-1, user_sat=-1, user_flip=-1; static int use_fuji_rotate=1, write_to_stdout=0, quality, i, c; - static char opm, opt, *ofname, *cp, *bpfile=0; + static char opm, opt, *ofname, *cp2, *bpfile=0; + static const char *cp; static const char *sp, *dark_frame=0, *write_ext; static struct utimbuf ut; static FILE *ofp; @@ -8781,7 +8785,7 @@ thumbnail: strcpy (ofname,_("standard output")); else { strcpy (ofname, ifname); - if ((cp = strrchr (ofname, '.'))) *cp = 0; + if ((cp2 = strrchr (ofname, '.'))) *cp2 = 0; if (multi_out) sprintf (ofname+strlen(ofname), "_%0*d", snprintf(0,0,"%d",is_raw-1), shot_select);