fix crash in unsharp-mask plug-in (#966987)

gimp-2.8.4-unsharp-mask-crash.patch

@@ -0,0 +1,52 @@
+From 3ea3dc0347ecf0fd2df4b1ca25666e2a78da150c Mon Sep 17 00:00:00 2001
+From: Nils Philippsen <nils@redhat.com>
+Date: Mon, 27 May 2013 14:33:28 +0200
+Subject: [PATCH] patch: unsharp-mask-crash
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Squashed commit of the following:
+
+commit a8748094ec325bfeb856c603ece8c2026f0968ea
+Author: Téo Mazars <teo.mazars@ensimag.fr>
+Date:   Sun Apr 7 22:29:56 2013 +0200
+
+    Bug 695418 - Unsharp mask crashes for large radii
+
+    Make sure we are working on the image range
+    (cherry picked from commit 35cc644765c553b6feb24bd56133b6f9f74ed5e4)
+---
+ plug-ins/common/unsharp-mask.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/plug-ins/common/unsharp-mask.c b/plug-ins/common/unsharp-mask.c
+index e6e3ad8..998c96e 100644
+--- a/plug-ins/common/unsharp-mask.c
++++ b/plug-ins/common/unsharp-mask.c
+@@ -369,7 +369,7 @@ box_blur_line (const gint    box_width,   /* Width of the kernel           */
+       /* If the leading edge has gone off the image, but the output and
+        * trailing edge are on the image. (The big loop exits when the
+        * output goes off the image. */
+-      else
++      else if (trail >= 0)
+         {
+           for (i = 0; i < bpp; i++)
+             {
+@@ -377,6 +377,13 @@ box_blur_line (const gint    box_width,   /* Width of the kernel           */
+               dest[bpp * output + i] = (ac[i] + (coverage >> 1)) / coverage;
+             }
+         }
++      /* Leading has gone off the image and trailing isn't yet in it
++       * (small image) */
++      else if (output >= 0)
++        {
++          for (i = 0; i < bpp; i++)
++            dest[bpp * output + i] = (ac[i] + (coverage >> 1)) / coverage;
++        }
+ 
+       lead++;
+       output++;
+-- 
+1.8.1.4
+

gimp.spec

@@ -215,6 +215,9 @@ Patch4:         gimp-2.8.4-tag-popup-crash.patch
 # Fix double-free crashes when selecting gradients from script-fu.
 # Upstream commit 15c5a9db32d49b22260ffde0202f39284b99d936
 Patch5:         gimp-2.8.4-script-fu-gradient.patch
+# Fix crashes in unsharp-mask plug-in.
+# Upstream commit 38d8312fdebee98a20b33807b09d8a832a4b97b7
+Patch6:         gimp-2.8.4-unsharp-mask-crash.patch
 
 %description
 GIMP (GNU Image Manipulation Program) is a powerful image composition and
@@ -305,6 +308,7 @@ EOF
 %patch3 -p1 -b .mime-types
 %patch4 -p1 -b .tag-popup-crash
 %patch5 -p1 -b .script-fu-gradient
+%patch6 -p1 -b .unsharp-mask-crash
 
 %build
 %if %{with hardening}
@@ -599,9 +603,10 @@ gtk-update-icon-cache %{_datadir}/icons/hicolor &>/dev/null || :
 %endif
 
 %changelog
-* Wed May 22 2013 Nils Philippsen <nils@redhat.com>
+* Mon May 27 2013 Nils Philippsen <nils@redhat.com>
 - fix upstream commit ids
 - fix double-free crashes when selecting gradients from script-fu (#964470)
+- fix crash in unsharp-mask plug-in (#966987)
 
 * Sat Apr 20 2013 Nils Philippsen <nils@redhat.com> - 2:2.8.4-3
 - don't crash upon deleting tags in popup (#892828)