From 40d8a8557ec773376e322e142213ffd2f98ad330 Mon Sep 17 00:00:00 2001
From: Andrew Lukoshko <alukoshko@almalinux.org>
Date: Wed, 12 Aug 2026 10:20:50 +0000
Subject: [PATCH] Fix CVE-2026-2050

---
 SOURCES/gegl04-CVE-2026-2050.patch | 34 ++++++++++++++++++++++++++++++
 SPECS/gegl04.spec                  |  7 +++++-
 2 files changed, 40 insertions(+), 1 deletion(-)
 create mode 100644 SOURCES/gegl04-CVE-2026-2050.patch

diff --git a/SOURCES/gegl04-CVE-2026-2050.patch b/SOURCES/gegl04-CVE-2026-2050.patch
new file mode 100644
index 0000000..720314f
--- /dev/null
+++ b/SOURCES/gegl04-CVE-2026-2050.patch
@@ -0,0 +1,34 @@
+From ea7921795ee5d90f42ca8f829fdbd0a5c6c560ca Mon Sep 17 00:00:00 2001
+From: Gabriele Barbero <barbero.gabriele03@gmail.com>
+Date: Fri, 5 Dec 2025 00:20:22 +0100
+Subject: [PATCH] ZDI-CAN-28266: guard against buffer overflow
+
+In rgbe_read_new_rle we check whether there is still space in the buffer,
+but we do not verify that the run length fits within the remaining capacity.
+This can lead to a buffer overflow. This patch adds a check to ensure that
+the run length does not exceed the available space.
+---
+ libs/rgbe/rgbe.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/libs/rgbe/rgbe.c b/libs/rgbe/rgbe.c
+index eedde2660..2f52fb18b 100644
+--- a/libs/rgbe/rgbe.c
++++ b/libs/rgbe/rgbe.c
+@@ -670,6 +670,13 @@ rgbe_read_new_rle (const rgbe_file *file,
+ 
+           data++;
+ 
++          /* Check if there's enought space in the buffer to avoid OOB */
++          if (length > (pixels + RGBE_NUM_RGBE * linesize - pixoffset[component]) / RGBE_NUM_RGBE)
++            {
++              g_warning ("Buffer overflow detected.");
++              return FALSE;
++            }
++        
+           /* A compressed run */
+           if (rle)
+             {
+-- 
+2.52.0
+
diff --git a/SPECS/gegl04.spec b/SPECS/gegl04.spec
index 45aa957..ce409b5 100644
--- a/SPECS/gegl04.spec
+++ b/SPECS/gegl04.spec
@@ -2,7 +2,7 @@
 
 Name:           gegl04
 Version:        0.4.62
-Release:        1%{?dist}
+Release:        1%{?dist}.1
 Summary:        Graph based image processing framework
 
 # The binary is under the GPL, while the libs are under LGPL.
@@ -13,6 +13,8 @@ Source0:        http://download.gimp.org/pub/gegl/%{apiver}/gegl-%{version}.tar.
 
 Patch0:         gegl04-openexr.patch
 Patch1:         gegl04-gtk.patch
+# https://github.com/GNOME/gegl/commit/d32f1badb4bde1d6e8137f687d9ee1195768d4ed
+Patch2:         gegl04-CVE-2026-2050.patch
 
 BuildRequires:  chrpath
 BuildRequires:  enscript
@@ -174,6 +176,9 @@ chrpath --delete %{buildroot}%{_libdir}/gegl-%{apiver}/*.so
 
 
 %changelog
+* Mon Jul 13 2026 Josef Ridky <jridky@redhat.com> - 0.4.62-1.1
+- Fix CVE-2026-2050 (RHEL-188266)
+
 * Tue May 20 2025 Josef Ridky <jridky@redhat.com> - 0.4.62-1
 - New upstream release 0.4.62 (RHEL-88143)