Confirmed, thanks for the sample file.
Input file : M22-1343_000000.dng
Camera : Canon EOS 5D Mark III
Full size : 1808 x 2268
Active area : 5424 x 2268
Black borders : N/A
ISO pattern : dBBd RGGB
==759831== Invalid read of size 2
==759831== at 0x116922: raw_get_pixel16 (cr2hdr.c:467)
==759831== by 0x116922: white_detect (cr2hdr.c:943)
==759831== by 0x10B65B: hdr_interpolate (cr2hdr.c:2041)
==759831== by 0x10B65B: main (cr2hdr.c:773)
==759831== Address 0x4f613e8 is 1,824,752 bytes inside an unallocated block of size 1,831,920 in arena "client"
raw_info.buffer is not valid at point of use in raw_get_pixel16(). In hdr_interpolate(), we do this:
if (!rggb) /* this code assumes RGGB, so we need to skip one line */
{
raw_info.buffer += raw_info.pitch;
For this file, rggb is true, so we don't adjust the buffer... but it's not clear to me where it's initially set (it's a global and annoying to track, and I'm unfamiliar with this code).