From edcdf804662eb4340fdc371af4853d6579e969ab Mon Sep 17 00:00:00 2001
From: Marcus Meissner <marcus@jet.franken.de>
Date: Wed, 8 Apr 2026 15:07:38 +0200
Subject: [PATCH] =?UTF-8?q?Fixed=20UINT128/INT128=20Unchecked=20Offset=20A?=
 =?UTF-8?q?dvance=20(CWE-125)=20=E2=80=94=20MEDIUM?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Finding 5: UINT128/INT128 Unchecked Offset Advance (CWE-125) — MEDIUM

In ptp_unpack_DPV(), the PTP_DTC_UINT128 and PTP_DTC_INT128 cases advance *offset += 16 without verifying 16 bytes remain. The entry check at line 609 only guarantees *offset < total (at least 1 byte available). After the unchecked advance, *offset can exceed total, and the CTVAL macro's bounds check (total - *offset < sizeof(target)) wraps due to unsigned arithmetic.

CVE-2026-40335

Reported-By: Sebastián Alba <sebasjosue84@gmail.com>

CVE: CVE-2026-40335
Upstream-Status: Backport [https://github.com/gphoto/libgphoto2/commit/433bde9888d70aa726e32744cd751d7dbe94379a]
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
---
 camlibs/ptp2/ptp-pack.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/camlibs/ptp2/ptp-pack.c b/camlibs/ptp2/ptp-pack.c
index 982b4f4..7fc120d 100644
--- a/camlibs/ptp2/ptp-pack.c
+++ b/camlibs/ptp2/ptp-pack.c
@@ -614,10 +614,14 @@ ptp_unpack_DPV (
 	case PTP_DTC_UINT64: CTVAL(value->u64,dtoh64a); break;
 
 	case PTP_DTC_UINT128:
+		if (total - *offset < 16)
+			return 0;
 		*offset += 16;
 		/*fprintf(stderr,"unhandled unpack of uint128n");*/
 		break;
 	case PTP_DTC_INT128:
+		if (total - *offset < 16)
+			return 0;
 		*offset += 16;
 		/*fprintf(stderr,"unhandled unpack of int128n");*/
 		break;
