CVE-2020-35534: 
NixOS vulnerability analysis and mitigation

A memory corruption vulnerability was identified in LibRaw's crxFreeSubbandData() function (located in libraw\src\decoders\crx.cpp) when processing CR3 files. The vulnerability was assigned CVE-2020-35534 and was discovered in December 2020 (NVD, CVE).

The vulnerability exists in the crxFreeSubbandData() function within the CR3 decoder component of LibRaw. The issue manifests as a memory corruption when processing CR3 image files, specifically during the cleanup of subband data. The vulnerability can be triggered when processing specially crafted CR3 files (GitHub Issue).

When exploited, this vulnerability can lead to memory corruption in applications using the LibRaw library to process CR3 files. This could potentially result in application crashes or unpredictable behavior when processing maliciously crafted CR3 image files (GitHub Issue).

A proof-of-concept exploit has been demonstrated using a specially crafted CR3 file that triggers the vulnerability when processed through applications using LibRaw, such as ImageMagick's convert command (GitHub Issue).

The vulnerability has been addressed through a patch that implements memory pool management for CR3 decoder memory allocations. The fix was committed to the LibRaw repository and involves using mempool for memory management in the CR3 decoder (LibRaw Commit).