diff --git a/rtengine/dcraw.cc b/rtengine/dcraw.cc index 55f637f24..b41d2fa10 100644 --- a/rtengine/dcraw.cc +++ b/rtengine/dcraw.cc @@ -7842,6 +7842,8 @@ void CLASS parse_qt (int end) while (ftell(ifp)+7 < end) { save = ftell(ifp); if ((size = get4()) < 8) return; + if ((int)size < 0) return; // 2+GB is too much + if (save + size < save) return; // 32bit overflow fread (tag, 4, 1, ifp); if (!memcmp(tag,"moov",4) || !memcmp(tag,"udta",4) || diff --git a/rtengine/simpleprocess.cc b/rtengine/simpleprocess.cc index 5d8631738..c9307d623 100644 --- a/rtengine/simpleprocess.cc +++ b/rtengine/simpleprocess.cc @@ -277,10 +277,10 @@ private: currWB = ColorTemp(params.wb.temperature, params.wb.green, params.wb.equal, params.wb.method, params.wb.observer); ColorTemp currWBitc; - if (params.wb.method == "autitcgreen" && flush) { + if (params.wb.method == "autitcgreen") { imgsrc->getrgbloc(0, 0, fh, fw, 0, 0, fh, fw, params.wb); } - const bool autowb = (params.wb.method == "autitcgreen" && imgsrc->isRAW() && flush); + const bool autowb = (params.wb.method == "autitcgreen" && imgsrc->isRAW()); ColorTemp autoWB; int dread = 0; int bia = 1;