rpms/gimp
7
0
Fork 0
Code Issues Pull Requests Releases Activity

import CS git gimp-2.8.22-26.el8.5

Browse Source
This commit is contained in:
AlmaLinux RelEng Bot 2026-03-20 03:54:59 -04:00
parent 7aeefe6bf1
commit 0420826cb8
5 changed files with 181 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

60
SOURCES/gimp-3.0.4-CVE-2026-0797.patch Normal file
View File

@ -0,0 +1,60 @@
diff -urNp a/plug-ins/file-ico/ico-load.c b/plug-ins/file-ico/ico-load.c
--- a/plug-ins/file-ico/ico-load.c 2026-03-12 09:31:15.473428077 +0100
+++ b/plug-ins/file-ico/ico-load.c 2026-03-12 09:37:30.146691264 +0100
@@ -69,7 +69,9 @@ ico_read_int32 (FILE *fp,
total = count;
if (count > 0)
{
- ico_read_int8 (fp, (guint8 *) data, count * 4);
+ if (ico_read_int8 (fp, (guint8 *) data, count * 4) != (count * 4))
+ return FALSE;
+
for (i = 0; i < count; i++)
data[i] = GUINT32_FROM_LE (data[i]);
}
@@ -88,7 +90,9 @@ ico_read_int16 (FILE *fp,
total = count;
if (count > 0)
{
- ico_read_int8 (fp, (guint8 *) data, count * 2);
+ if (ico_read_int8 (fp, (guint8 *) data, count * 2) != (count * 2))
+ return FALSE;
+
for (i = 0; i < count; i++)
data[i] = GUINT16_FROM_LE (data[i]);
}
@@ -109,8 +113,8 @@ ico_read_int8 (FILE *fp,
while (count > 0)
{
bytes = fread ((gchar *) data, sizeof (gchar), count, fp);
- if (bytes <= 0) /* something bad happened */
- break;
+ if (bytes != count) /* something bad happened */
+ return -1;
count -= bytes;
data += bytes;
@@ -485,11 +489,21 @@ ico_read_icon (FILE *fp,
data.used_clrs, data.bpp));
palette = g_new0 (guint32, data.used_clrs);
- ico_read_int8 (fp, (guint8 *) palette, data.used_clrs * 4);
+ if (ico_read_int8 (fp,
+ (guint8 *) palette,
+ data.used_clrs * 4) != (data.used_clrs * 4))
+ {
+ D(("skipping image: too large\n"));
+ return FALSE;
+ }
}
xor_map = ico_alloc_map (w, h, data.bpp, &length);
- ico_read_int8 (fp, xor_map, length);
+ if (ico_read_int8 (fp, xor_map, length) != length)
+ {
+ D(("skipping image: too large\n"));
+ return FALSE;
+ }
D((" length of xor_map: %i\n", length));
/* Read in and_map. It's padded out to 32 bits per line: */

12
SOURCES/gimp-3.0.4-CVE-2026-2044.patch Normal file
View File

@ -0,0 +1,12 @@
diff -urNp a/plug-ins/common/file-pnm.c b/plug-ins/common/file-pnm.c
--- a/plug-ins/common/file-pnm.c 2026-03-12 09:38:41.520106766 +0100
+++ b/plug-ins/common/file-pnm.c 2026-03-12 09:39:56.763121548 +0100
@@ -502,7 +502,7 @@ load_image (const gchar *filename,
gimp_filename_to_utf8 (filename));
/* allocate the necessary structures */
- pnminfo = g_new (PNMInfo, 1);
+ pnminfo = g_new0 (PNMInfo, 1);
scan = NULL;
/* set error handling */

22
SOURCES/gimp-3.0.4-CVE-2026-2045.patch Normal file
View File

@ -0,0 +1,22 @@
diff -urNp a/plug-ins/common/file-xwd.c b/plug-ins/common/file-xwd.c
--- a/plug-ins/common/file-xwd.c 2026-03-12 16:08:36.705154763 +0100
+++ b/plug-ins/common/file-xwd.c 2026-03-12 16:17:00.392062368 +0100
@@ -1578,7 +1578,17 @@ load_xwd_f2_d16_b16 (const gchar *fi
for (j = 0; j < ncols; j++)
{
- cm = ColorMap + xwdcolmap[j].l_pixel * 3;
+ guint32 offset = xwdcolmap[j].l_pixel * 3;
+
+ if (offset+2 >= maxval)
+ {
+ g_message (_("Invalid colormap offset. Possibly corrupt image."));
+ g_free (data);
+ g_free (ColorMap);
+ return NULL;
+ }
+
+ cm = ColorMap + offset;
*(cm++) = (xwdcolmap[j].l_red >> 8);
*(cm++) = (xwdcolmap[j].l_green >> 8);
*cm = (xwdcolmap[j].l_blue >> 8);

71
SOURCES/gimp-3.0.4-CVE-2026-2048.patch Normal file
View File

@ -0,0 +1,71 @@
diff -urNp a/plug-ins/common/file-xwd.c b/plug-ins/common/file-xwd.c
--- a/plug-ins/common/file-xwd.c 2026-03-12 09:43:44.345971536 +0100
+++ b/plug-ins/common/file-xwd.c 2026-03-12 10:03:48.715473121 +0100
@@ -1886,7 +1886,8 @@ load_xwd_f1_d24_b1 (const gchar *fi
glong data_offset, plane_offset, tile_offset;
gulong redmask, greenmask, bluemask;
guint redshift, greenshift, blueshift;
- gulong g;
+ guint32 g;
+ guint32 maxval;
guchar redmap[256], greenmap[256], bluemap[256];
guchar bit_reverse[256];
guchar *xwddata, *xwdin, *data;
@@ -1977,7 +1978,8 @@ load_xwd_f1_d24_b1 (const gchar *fi
&layer_ID, &drawable, &pixel_rgn);
tile_height = gimp_tile_height ();
- data = g_malloc (tile_height * width * bytes_per_pixel);
+ data = g_malloc (tile_height * width * bytes_per_pixel);
+ maxval = tile_height * width * bytes_per_pixel;
ncols = xwdhdr->l_colormap_entries;
if (xwdhdr->l_ncolors < ncols)
@@ -2002,6 +2004,8 @@ load_xwd_f1_d24_b1 (const gchar *fi
for (tile_start = 0; tile_start < height; tile_start += tile_height)
{
+ guint current_dest = 0;
+
memset (data, 0, width*tile_height*bytes_per_pixel);
tile_end = tile_start + tile_height - 1;
@@ -2025,7 +2029,18 @@ load_xwd_f1_d24_b1 (const gchar *fi
else /* 3 bytes per pixel */
{
fromright = xwdhdr->l_pixmap_depth-1-plane;
- dest += 2 - fromright/8;
+
+ current_dest += 2 - fromright / 8;
+ if (current_dest < maxval)
+ {
+ dest += 2 - fromright / 8;
+ }
+ else
+ {
+ err = 1;
+ break;
+ }
+
outmask = (1 << (fromright % 8));
}
@@ -2080,7 +2095,17 @@ load_xwd_f1_d24_b1 (const gchar *fi
if (g & inmask)
*dest |= outmask;
- dest += bytes_per_pixel;
+
+ current_dest += bytes_per_pixel;
+ if (current_dest < maxval)
+ {
+ dest += bytes_per_pixel;
+ }
+ else
+ {
+ err = 1;
+ break;
+ }
inmask >>= 1;
}

17
SPECS/gimp.spec
View File

@ -75,7 +75,7 @@ Summary: GNU Image Manipulation Program
Name: gimp
Epoch: 2
Version: 2.8.22
Release: %{?prerelprefix}26%{dotprerel}%{dotgitrev}%{?dist}.4
Release: %{?prerelprefix}26%{dotprerel}%{dotgitrev}%{?dist}.5
# Compute some version related macros.
# Ugly, need to get quoting percent signs straight.
@ -222,6 +222,11 @@ Patch18: gimp-CVE-2025-48798.patch
Patch19: gimp-CVE-2025-5473.patch
Patch20: gimp-3.0.4-CVE-2025-10920-10925-10934.patch
Patch21: gimp-3.0.4-CVE-2025-14422.patch
Patch22: gimp-3.0.4-CVE-2026-0797.patch
Patch23: gimp-3.0.4-CVE-2026-2044.patch
Patch24: gimp-3.0.4-CVE-2026-2045.patch
Patch25: gimp-3.0.4-CVE-2026-2048.patch
# use external help browser directly if help browser plug-in is not built
Patch100: gimp-2.8.6-external-help-browser.patch
@ -327,6 +332,10 @@ EOF
%patch19 -p1 -b .CVE-2025-5473
%patch20 -p1 -b .CVE-2025-10920-10925-10934
%patch21 -p1 -b .CVE-2025-14422
%patch22 -p1 -b .CVE-2026-0797
%patch23 -p1 -b .CVE-2026-2044
%patch24 -p1 -b .CVE-2026-2045
%patch25 -p1 -b .CVE-2026-2048
%if ! %{with helpbrowser}
%patch100 -p1 -b .external-help-browser
@ -666,6 +675,12 @@ make check
%endif
%changelog
* Thu Mar 12 2026 Josef Ridky <jridky@redhat.com> - 2:2.8.22-26.5
- fix CVE-2026-0797
- fix CVE-2026-2044
- fix CVE-2026-2045
- fix CVE-2026-2048
* Tue Jan 20 2026 Josef Ridky <jridky@redhat.com> - 2:2.8.22-26.4
- fix CVE-2025-14422