From c25887e889f210652ddae9f5df57e56d89acfbeb Mon Sep 17 00:00:00 2001 From: eabdullin Date: Tue, 5 Aug 2025 05:08:21 +0000 Subject: [PATCH] import UBI gdk-pixbuf2-2.42.6-6.el9_6 --- ...e-more-careful-with-chunked-icc-data.patch | 50 +++++++++++++++++++ SPECS/gdk-pixbuf2.spec | 11 +++- 2 files changed, 60 insertions(+), 1 deletion(-) create mode 100644 SOURCES/0001-jpeg-Be-more-careful-with-chunked-icc-data.patch diff --git a/SOURCES/0001-jpeg-Be-more-careful-with-chunked-icc-data.patch b/SOURCES/0001-jpeg-Be-more-careful-with-chunked-icc-data.patch new file mode 100644 index 0000000..09266e4 --- /dev/null +++ b/SOURCES/0001-jpeg-Be-more-careful-with-chunked-icc-data.patch @@ -0,0 +1,50 @@ +From 4af78023ce7d3b5e3cec422a59bb4f48fa4f5886 Mon Sep 17 00:00:00 2001 +From: Matthias Clasen +Date: Fri, 11 Jul 2025 11:02:05 -0400 +Subject: [PATCH] jpeg: Be more careful with chunked icc data + +We we inadvertendly trusting the sequence numbers not to lie. +If they do we would report a larger data size than we actually +allocated, leading to out of bounds memory access in base64 +encoding later on. + +This has been assigned CVE-2025-7345. + +Fixes: #249 +--- + gdk-pixbuf/io-jpeg.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/gdk-pixbuf/io-jpeg.c b/gdk-pixbuf/io-jpeg.c +index 9cfd29718..103820c5a 100644 +--- a/gdk-pixbuf/io-jpeg.c ++++ b/gdk-pixbuf/io-jpeg.c +@@ -359,6 +359,7 @@ jpeg_parse_exif_app2_segment (JpegExifContext *context, jpeg_saved_marker_ptr ma + context->icc_profile = g_new (gchar, chunk_size); + /* copy the segment data to the profile space */ + memcpy (context->icc_profile, marker->data + 14, chunk_size); ++ ret = TRUE; + goto out; + } + +@@ -380,12 +381,15 @@ jpeg_parse_exif_app2_segment (JpegExifContext *context, jpeg_saved_marker_ptr ma + /* copy the segment data to the profile space */ + memcpy (context->icc_profile + offset, marker->data + 14, chunk_size); + +- /* it's now this big plus the new data we've just copied */ +- context->icc_profile_size += chunk_size; ++ context->icc_profile_size = MAX (context->icc_profile_size, offset + chunk_size); + + /* success */ + ret = TRUE; + out: ++ if (!ret) { ++ g_free (context->icc_profile); ++ context->icc_profile = NULL; ++ } + return ret; + } + +-- +2.50.0 + diff --git a/SPECS/gdk-pixbuf2.spec b/SPECS/gdk-pixbuf2.spec index feaa6c6..4072081 100644 --- a/SPECS/gdk-pixbuf2.spec +++ b/SPECS/gdk-pixbuf2.spec @@ -2,7 +2,7 @@ Name: gdk-pixbuf2 Version: 2.42.6 -Release: 4%{?dist} +Release: 6%{?dist} Summary: An image loading library License: LGPLv2+ @@ -12,6 +12,7 @@ Source0: https://download.gnome.org/sources/gdk-pixbuf/2.42/gdk-pixbuf-%{ Patch0: gif-check-for-overflow.patch Patch1: gif-lzw-code-size-overflow.patch Patch2: CVE-2022-48622.patch +Patch3: 0001-jpeg-Be-more-careful-with-chunked-icc-data.patch BuildRequires: docbook-style-xsl BuildRequires: gettext @@ -122,6 +123,14 @@ gdk-pixbuf-query-loaders-%{__isa_bits} --update-cache %{_datadir}/installed-tests %changelog +* Fri Jul 11 2025 Matthias Clasen - 2.42.6-6 +- Fix an oversight +- Related: RHEL-102354 + +* Fri Jul 11 2025 Matthias Clasen - 2.42.6-5 +- Backport fixes for CVE-2025-7345 +- Resolves: RHEL-102354 + * Wed May 15 2024 Tomas Popela - 2.42.6-4 - Backport fixes for CVE-2022-48622 - Resolves: RHEL-36432