From 585e8113b541469347d09c341c2e8b468b431adb Mon Sep 17 00:00:00 2001
From: Marcus Meissner <marcus@jet.franken.de>
Date: Sat, 11 Apr 2026 10:50:47 +0200
Subject: [PATCH] =?UTF-8?q?Fixed=20Sony=20DPD=20FormFlag=20OOB=20Read=20(C?=
 =?UTF-8?q?WE-125)=20=E2=80=94=20MEDIUM?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

ptp_unpack_Sony_DPD() reads the FormFlag byte via dtoh8o(data, *poffset)
without a prior bounds check. The standard ptp_unpack_DPD() at line
686–687 correctly validates *offset + sizeof(uint8_t) > dpdlen before
this same read, but the Sony variant omits this check.

CVE-2026-40339

Reported-By: Sebastián Alba <sebasjosue84@gmail.com>

CVE: CVE-2026-40339
Upstream-Status: Backport [https://github.com/gphoto/libgphoto2/commit/09f8a940b1e418b5693f5c11e3016a1ad2cea62d]
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
---
 camlibs/ptp2/ptp-pack.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/camlibs/ptp2/ptp-pack.c b/camlibs/ptp2/ptp-pack.c
index f90d2a5..28648a5 100644
--- a/camlibs/ptp2/ptp-pack.c
+++ b/camlibs/ptp2/ptp-pack.c
@@ -833,9 +833,10 @@ ptp_unpack_Sony_DPD (PTPParams *params, const unsigned char* data, PTPDeviceProp
 	   code or the Data Type is a string (with two empty strings as
 	   values). In both cases Form Flag should be set to 0x00 and FORM is
 	   not present. */
-
 	if (*poffset==PTP_dpd_Sony_DefaultValue)
 		return 1;
+	if (*poffset + sizeof(uint8_t) > dpdlen)
+		return 1;
 
 	dpd->FormFlag = dtoh8o(data, *poffset);
 	ptp_debug (params, "formflag 0x%04x", dpd->FormFlag);
