rpms/gimp
7
0
Fork 0
Code Issues Pull Requests Releases Activity

import Oracle_OSS gimp-3.0.4-4.el9_8.7

Browse Source
This commit is contained in:
AlmaLinux RelEng Bot 2026-07-16 22:51:48 -04:00
parent 575a374f9c
commit 758c8543f4
3 changed files with 85 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
SOURCES/gimp-CVE-2026-58380.patch Normal file
View File

@ -0,0 +1,28 @@
From e5dcc36627ed4b19d12a70dc12f0f9eb51ae56ce Mon Sep 17 00:00:00 2001
From: Alx Sa <cmyk.student@gmail.com>
Date: Sat, 11 Apr 2026 14:33:42 +0000
Subject: [PATCH] plug-ins: Boost buffer size for pnmscanner_gettoken
Resolves #16206
pnmscanner_gettoken () in file-pnm assumes that the
buffer it receives is larger than its bufsize parameter.
In almost all cases this is true, except in pnm_load_ascii ().
This patch adds the + 4 that is used everywhere else to ensure
we don't have an issue with buffer overflow.
---
plug-ins/common/file-pnm.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/plug-ins/common/file-pnm.c b/plug-ins/common/file-pnm.c
index 65619be59d..81d73c1450 100644
--- a/plug-ins/common/file-pnm.c
+++ b/plug-ins/common/file-pnm.c
@@ -958,7 +958,7 @@ pnm_load_ascii (PNMScanner *scan,
gint x, y, i, b;
gint start, end, scanlines;
gint np;
- gchar buf[BUFLEN];
+ gchar buf[BUFLEN + 4];
gboolean aborted = FALSE;
np = (info->np) ? (info->np) : 1;

46
SOURCES/gimp-CVE-2026-58384.patch Normal file
View File

@ -0,0 +1,46 @@
From 0fd8931dcccbd055caefe242d9cf8f86073d2835 Mon Sep 17 00:00:00 2001
From: Alx Sa <cmyk.student@gmail.com>
Date: Sat, 11 Apr 2026 17:41:50 +0000
Subject: [PATCH] plug-ins: Guard against too large PSD channel sizes
Resolves #16216
If a PSD channel row size is intentionally set very high, multiplying
it by 4 in our code can cause an overflow and wraparound to a lower
value for memory allocation.
This patch adds checks to prevent this if the total size exceeds
G_MAXUINT32.
---
plug-ins/file-psd/psd-load.c | 13 ++++++++++++-
1 file changed, 12 insertions(+), 1 deletion(-)
diff --git a/plug-ins/file-psd/psd-load.c b/plug-ins/file-psd/psd-load.c
index 676f3da9b4..64e9a5d9a2 100644
--- a/plug-ins/file-psd/psd-load.c
+++ b/plug-ins/file-psd/psd-load.c
@@ -1790,6 +1790,7 @@ read_RLE_channel (PSDimage *img_a,
{
gint rle_count_size = (img_a->version == 1 ? 2 : 4);
gint rle_row_size = lyr_chn->rows * rle_count_size;
+ gsize row_allocation;
guint32 *rle_pack_len;
gint rowi;
@@ -1799,7 +1800,17 @@ read_RLE_channel (PSDimage *img_a,
channel_data_len - 2,
rle_row_size,
(channel_data_len - 2 - rle_row_size));
- rle_pack_len = g_malloc (lyr_chn->rows * 4); /* Always 4 since this is the data size in memory. */
+
+ /* Always 4 since this is the data size in memory. */
+ if (! g_size_checked_mul (&row_allocation, lyr_chn->rows, 4) ||
+ row_allocation >= G_MAXUINT32)
+ {
+ g_set_error (error, G_FILE_ERROR, G_FILE_ERROR_FAILED,
+ _("Unsupported or invalid channel size"));
+ return FALSE;
+ }
+
+ rle_pack_len = g_malloc ((guint32) row_allocation);
for (rowi = 0; rowi < lyr_chn->rows; ++rowi)
{
if (psd_read (input, &rle_pack_len[rowi], rle_count_size,

12
SPECS/gimp.spec
View File

@ -67,7 +67,7 @@ Name: gimp
Epoch: 2
Version: 3.0.4
%global rel 4
Release: %{rel}%{?dist}.5
Release: %{rel}%{?dist}.7
# https://bugzilla.redhat.com/show_bug.cgi?id=2318369
ExcludeArch: s390x
@ -273,6 +273,10 @@ Patch19: gimp-CVE-2026-4154.patch
Patch20: gimp-CVE-2026-4887.patch
# https://github.com/GNOME/gimp/commit/b630f167ba7b73b17e7dd6df1fee1623f8324575
Patch21: gimp-CVE-2026-58379.patch
# https://gitlab.gnome.org/GNOME/gimp/-/commit/da29e217
Patch22: gimp-CVE-2026-58384.patch
# https://gitlab.gnome.org/GNOME/gimp/-/commit/83699817
Patch23: gimp-CVE-2026-58380.patch
# use external help browser directly if help browser plug-in is not built
Patch100: gimp-3.0.2-external-help-browser.patch
@ -366,6 +370,8 @@ EOF
%patch19 -p1 -b .CVE-2026-4154
%patch20 -p1 -b .CVE-2026-4887
%patch21 -p1 -b .CVE-2026-58379
%patch22 -p1 -b .CVE-2026-58384
%patch23 -p1 -b .CVE-2026-58380
%patch100 -p1 -b .external-help-browser
@ -681,6 +687,10 @@ done
%endif
%changelog
* Fri Jul 10 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 2:3.0.4-4.6
- fix CVE-2026-58384
- Resolves: RHEL-192536
* Sat Jul 04 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 2:3.0.4-4.5
- fix CVE-2026-58379
- Resolves: RHEL-192170