Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 23 Nov 2018 19:33:55 -0600 (CST)
From: Bob Friesenhahn <>
Subject: Re: Re: Crashes and memory safety bugs in dcraw

On Fri, 23 Nov 2018, Ian Zimmerman wrote:
> An important side note: because dcraw intentionally doesn't provide a
> library, only an executable, code from it is bundled in at least some
> applications that use it; thus updating the dcraw package in a distro
> will not by itself be the end of this problem for the distro.  One such
> application : RawTherapee

GraphicsMagick also bundles some version of dcraw for its Microsoft 
Windows builds.  It is executed as an external program so if it 
becomes corrupted, it will not corrupt the invoking application.

Another consideration is that the dcraw author has huge sample image 
archive that he is only willing to sell for private use.  This means 
that other projects (including those which derived code from dcraw) 
might not work correctly with as many input files since they have not 
done as much validation.

Bob Friesenhahn,
GraphicsMagick Maintainer,
Public Key,

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.