From 0420826cb8790c63e67038748a4b6d644b825723 Mon Sep 17 00:00:00 2001 From: AlmaLinux RelEng Bot Date: Fri, 20 Mar 2026 03:54:59 -0400 Subject: [PATCH] import CS git gimp-2.8.22-26.el8.5 --- SOURCES/gimp-3.0.4-CVE-2026-0797.patch | 60 ++++++++++++++++++++++ SOURCES/gimp-3.0.4-CVE-2026-2044.patch | 12 +++++ SOURCES/gimp-3.0.4-CVE-2026-2045.patch | 22 ++++++++ SOURCES/gimp-3.0.4-CVE-2026-2048.patch | 71 ++++++++++++++++++++++++++ SPECS/gimp.spec | 17 +++++- 5 files changed, 181 insertions(+), 1 deletion(-) create mode 100644 SOURCES/gimp-3.0.4-CVE-2026-0797.patch create mode 100644 SOURCES/gimp-3.0.4-CVE-2026-2044.patch create mode 100644 SOURCES/gimp-3.0.4-CVE-2026-2045.patch create mode 100644 SOURCES/gimp-3.0.4-CVE-2026-2048.patch diff --git a/SOURCES/gimp-3.0.4-CVE-2026-0797.patch b/SOURCES/gimp-3.0.4-CVE-2026-0797.patch new file mode 100644 index 0000000..aa05b93 --- /dev/null +++ b/SOURCES/gimp-3.0.4-CVE-2026-0797.patch @@ -0,0 +1,60 @@ +diff -urNp a/plug-ins/file-ico/ico-load.c b/plug-ins/file-ico/ico-load.c +--- a/plug-ins/file-ico/ico-load.c 2026-03-12 09:31:15.473428077 +0100 ++++ b/plug-ins/file-ico/ico-load.c 2026-03-12 09:37:30.146691264 +0100 +@@ -69,7 +69,9 @@ ico_read_int32 (FILE *fp, + total = count; + if (count > 0) + { +- ico_read_int8 (fp, (guint8 *) data, count * 4); ++ if (ico_read_int8 (fp, (guint8 *) data, count * 4) != (count * 4)) ++ return FALSE; ++ + for (i = 0; i < count; i++) + data[i] = GUINT32_FROM_LE (data[i]); + } +@@ -88,7 +90,9 @@ ico_read_int16 (FILE *fp, + total = count; + if (count > 0) + { +- ico_read_int8 (fp, (guint8 *) data, count * 2); ++ if (ico_read_int8 (fp, (guint8 *) data, count * 2) != (count * 2)) ++ return FALSE; ++ + for (i = 0; i < count; i++) + data[i] = GUINT16_FROM_LE (data[i]); + } +@@ -109,8 +113,8 @@ ico_read_int8 (FILE *fp, + while (count > 0) + { + bytes = fread ((gchar *) data, sizeof (gchar), count, fp); +- if (bytes <= 0) /* something bad happened */ +- break; ++ if (bytes != count) /* something bad happened */ ++ return -1; + + count -= bytes; + data += bytes; +@@ -485,11 +489,21 @@ ico_read_icon (FILE *fp, + data.used_clrs, data.bpp)); + + palette = g_new0 (guint32, data.used_clrs); +- ico_read_int8 (fp, (guint8 *) palette, data.used_clrs * 4); ++ if (ico_read_int8 (fp, ++ (guint8 *) palette, ++ data.used_clrs * 4) != (data.used_clrs * 4)) ++ { ++ D(("skipping image: too large\n")); ++ return FALSE; ++ } + } + + xor_map = ico_alloc_map (w, h, data.bpp, &length); +- ico_read_int8 (fp, xor_map, length); ++ if (ico_read_int8 (fp, xor_map, length) != length) ++ { ++ D(("skipping image: too large\n")); ++ return FALSE; ++ } + D((" length of xor_map: %i\n", length)); + + /* Read in and_map. It's padded out to 32 bits per line: */ diff --git a/SOURCES/gimp-3.0.4-CVE-2026-2044.patch b/SOURCES/gimp-3.0.4-CVE-2026-2044.patch new file mode 100644 index 0000000..c024534 --- /dev/null +++ b/SOURCES/gimp-3.0.4-CVE-2026-2044.patch @@ -0,0 +1,12 @@ +diff -urNp a/plug-ins/common/file-pnm.c b/plug-ins/common/file-pnm.c +--- a/plug-ins/common/file-pnm.c 2026-03-12 09:38:41.520106766 +0100 ++++ b/plug-ins/common/file-pnm.c 2026-03-12 09:39:56.763121548 +0100 +@@ -502,7 +502,7 @@ load_image (const gchar *filename, + gimp_filename_to_utf8 (filename)); + + /* allocate the necessary structures */ +- pnminfo = g_new (PNMInfo, 1); ++ pnminfo = g_new0 (PNMInfo, 1); + + scan = NULL; + /* set error handling */ diff --git a/SOURCES/gimp-3.0.4-CVE-2026-2045.patch b/SOURCES/gimp-3.0.4-CVE-2026-2045.patch new file mode 100644 index 0000000..a8189d9 --- /dev/null +++ b/SOURCES/gimp-3.0.4-CVE-2026-2045.patch @@ -0,0 +1,22 @@ +diff -urNp a/plug-ins/common/file-xwd.c b/plug-ins/common/file-xwd.c +--- a/plug-ins/common/file-xwd.c 2026-03-12 16:08:36.705154763 +0100 ++++ b/plug-ins/common/file-xwd.c 2026-03-12 16:17:00.392062368 +0100 +@@ -1578,7 +1578,17 @@ load_xwd_f2_d16_b16 (const gchar *fi + + for (j = 0; j < ncols; j++) + { +- cm = ColorMap + xwdcolmap[j].l_pixel * 3; ++ guint32 offset = xwdcolmap[j].l_pixel * 3; ++ ++ if (offset+2 >= maxval) ++ { ++ g_message (_("Invalid colormap offset. Possibly corrupt image.")); ++ g_free (data); ++ g_free (ColorMap); ++ return NULL; ++ } ++ ++ cm = ColorMap + offset; + *(cm++) = (xwdcolmap[j].l_red >> 8); + *(cm++) = (xwdcolmap[j].l_green >> 8); + *cm = (xwdcolmap[j].l_blue >> 8); diff --git a/SOURCES/gimp-3.0.4-CVE-2026-2048.patch b/SOURCES/gimp-3.0.4-CVE-2026-2048.patch new file mode 100644 index 0000000..9d1e541 --- /dev/null +++ b/SOURCES/gimp-3.0.4-CVE-2026-2048.patch @@ -0,0 +1,71 @@ +diff -urNp a/plug-ins/common/file-xwd.c b/plug-ins/common/file-xwd.c +--- a/plug-ins/common/file-xwd.c 2026-03-12 09:43:44.345971536 +0100 ++++ b/plug-ins/common/file-xwd.c 2026-03-12 10:03:48.715473121 +0100 +@@ -1886,7 +1886,8 @@ load_xwd_f1_d24_b1 (const gchar *fi + glong data_offset, plane_offset, tile_offset; + gulong redmask, greenmask, bluemask; + guint redshift, greenshift, blueshift; +- gulong g; ++ guint32 g; ++ guint32 maxval; + guchar redmap[256], greenmap[256], bluemap[256]; + guchar bit_reverse[256]; + guchar *xwddata, *xwdin, *data; +@@ -1977,7 +1978,8 @@ load_xwd_f1_d24_b1 (const gchar *fi + &layer_ID, &drawable, &pixel_rgn); + + tile_height = gimp_tile_height (); +- data = g_malloc (tile_height * width * bytes_per_pixel); ++ data = g_malloc (tile_height * width * bytes_per_pixel); ++ maxval = tile_height * width * bytes_per_pixel; + + ncols = xwdhdr->l_colormap_entries; + if (xwdhdr->l_ncolors < ncols) +@@ -2002,6 +2004,8 @@ load_xwd_f1_d24_b1 (const gchar *fi + + for (tile_start = 0; tile_start < height; tile_start += tile_height) + { ++ guint current_dest = 0; ++ + memset (data, 0, width*tile_height*bytes_per_pixel); + + tile_end = tile_start + tile_height - 1; +@@ -2025,7 +2029,18 @@ load_xwd_f1_d24_b1 (const gchar *fi + else /* 3 bytes per pixel */ + { + fromright = xwdhdr->l_pixmap_depth-1-plane; +- dest += 2 - fromright/8; ++ ++ current_dest += 2 - fromright / 8; ++ if (current_dest < maxval) ++ { ++ dest += 2 - fromright / 8; ++ } ++ else ++ { ++ err = 1; ++ break; ++ } ++ + outmask = (1 << (fromright % 8)); + } + +@@ -2080,7 +2095,17 @@ load_xwd_f1_d24_b1 (const gchar *fi + + if (g & inmask) + *dest |= outmask; +- dest += bytes_per_pixel; ++ ++ current_dest += bytes_per_pixel; ++ if (current_dest < maxval) ++ { ++ dest += bytes_per_pixel; ++ } ++ else ++ { ++ err = 1; ++ break; ++ } + + inmask >>= 1; + } diff --git a/SPECS/gimp.spec b/SPECS/gimp.spec index 7c2e70d..3b01b63 100644 --- a/SPECS/gimp.spec +++ b/SPECS/gimp.spec @@ -75,7 +75,7 @@ Summary: GNU Image Manipulation Program Name: gimp Epoch: 2 Version: 2.8.22 -Release: %{?prerelprefix}26%{dotprerel}%{dotgitrev}%{?dist}.4 +Release: %{?prerelprefix}26%{dotprerel}%{dotgitrev}%{?dist}.5 # Compute some version related macros. # Ugly, need to get quoting percent signs straight. @@ -222,6 +222,11 @@ Patch18: gimp-CVE-2025-48798.patch Patch19: gimp-CVE-2025-5473.patch Patch20: gimp-3.0.4-CVE-2025-10920-10925-10934.patch Patch21: gimp-3.0.4-CVE-2025-14422.patch +Patch22: gimp-3.0.4-CVE-2026-0797.patch +Patch23: gimp-3.0.4-CVE-2026-2044.patch +Patch24: gimp-3.0.4-CVE-2026-2045.patch +Patch25: gimp-3.0.4-CVE-2026-2048.patch + # use external help browser directly if help browser plug-in is not built Patch100: gimp-2.8.6-external-help-browser.patch @@ -327,6 +332,10 @@ EOF %patch19 -p1 -b .CVE-2025-5473 %patch20 -p1 -b .CVE-2025-10920-10925-10934 %patch21 -p1 -b .CVE-2025-14422 +%patch22 -p1 -b .CVE-2026-0797 +%patch23 -p1 -b .CVE-2026-2044 +%patch24 -p1 -b .CVE-2026-2045 +%patch25 -p1 -b .CVE-2026-2048 %if ! %{with helpbrowser} %patch100 -p1 -b .external-help-browser @@ -666,6 +675,12 @@ make check %endif %changelog +* Thu Mar 12 2026 Josef Ridky - 2:2.8.22-26.5 +- fix CVE-2026-0797 +- fix CVE-2026-2044 +- fix CVE-2026-2045 +- fix CVE-2026-2048 + * Tue Jan 20 2026 Josef Ridky - 2:2.8.22-26.4 - fix CVE-2025-14422