rpms/gimp
7
0
Fork 0
Code Issues Pull Requests Releases Activity

import Oracle_OSS gimp-3.0.4-4.el9_8.9

Browse Source
This commit is contained in:
AlmaLinux RelEng Bot 2026-08-06 02:11:47 -04:00
parent 758c8543f4
commit 777d9608e5
4 changed files with 392 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

73
SOURCES/gimp-CVE-2026-42169.patch Normal file
View File

@ -0,0 +1,73 @@
From 0ffd587d816dbc73b091b2eba4591d61fe17af95 Mon Sep 17 00:00:00 2001
From: Gabriele Barbero <barbero.gabriele03@gmail.com>
Date: Fri, 3 Apr 2026 19:32:16 +0200
Subject: [PATCH 1/2] plug-ins: validate fcTL frame dimensions...
...against IHDR bounds in APNG loader
The pixel buffer is allocated using base image dimensions from the IHDR
chunk, but row write offsets were computed using the per-frame dimensions
from the fcTL chunk with no bounds check. A crafted APNG file with
fcTL.width > IHDR.width or fcTL.height > IHDR.height would cause
out-of-bounds writes into the heap on every row after row 0.
Reject fcTL frames whose dimensions or offsets extend beyond the base
image dimensions before proceeding with decoding.
---
plug-ins/common/file-png.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/plug-ins/common/file-png.c b/plug-ins/common/file-png.c
index 0679019be3..a90f52f100 100644
--- a/plug-ins/common/file-png.c
+++ b/plug-ins/common/file-png.c
@@ -1186,6 +1186,7 @@ load_image (GFile *file,
return (GimpImage *) image;
}
+
/*
* 'offsets_dialog ()' - Asks the user about offsets when loading.
*/
From 16fe5a7cccba25385077c5ee726603dc60c55eb8 Mon Sep 17 00:00:00 2001
From: Alx Sa <cmyk.student@gmail.com>
Date: Fri, 10 Apr 2026 02:27:51 +0000
Subject: [PATCH 2/2] plug-in: Protect against invalid BPP in DDS import
Resolves #16161
DDS images have multiple locations for loading BPP values.
It is possible to craft a DDS file with conflicting BPP values
so that not enough space is allocated to read in the image.
This patch adds checks to make sure we use the largest BPP
value to allocate space to prevent this.
---
plug-ins/file-dds/ddsread.c | 11 ++++++++---
1 file changed, 8 insertions(+), 3 deletions(-)
diff --git a/plug-ins/file-dds/ddsread.c b/plug-ins/file-dds/ddsread.c
index 85a0e20b85..41285e2505 100644
--- a/plug-ins/file-dds/ddsread.c
+++ b/plug-ins/file-dds/ddsread.c
@@ -229,13 +229,18 @@ read_dds (GFile *file,
/* If format search was successful, get info needed to parse the file */
if (load_info.d3d9_format || load_info.dxgi_format)
{
+ gint d3d9_bpp = 0;
+ gint dxgi_bpp = 0;
+
load_info.read_info = get_format_read_info (load_info.d3d9_format,
load_info.dxgi_format);
- if ((! hdr.pixelfmt.bpp) && load_info.d3d9_format)
- hdr.pixelfmt.bpp = get_bpp_d3d9 (load_info.d3d9_format);
+ if (load_info.d3d9_format)
+ d3d9_bpp = get_bpp_d3d9 (load_info.d3d9_format);
else if (load_info.dxgi_format)
- hdr.pixelfmt.bpp = get_bpp_dxgi (load_info.dxgi_format);
+ dxgi_bpp = get_bpp_dxgi (load_info.dxgi_format);
+
+ hdr.pixelfmt.bpp = MAX (MAX (hdr.pixelfmt.bpp, d3d9_bpp), dxgi_bpp);
/* Unset the FourCC flag as D3D formats will be handled as uncompressed */
if ((load_info.fmt_flags & DDPF_FOURCC) && load_info.d3d9_format)

129
SOURCES/gimp-CVE-2026-66758.patch Normal file
View File

@ -0,0 +1,129 @@
From 9061982fec1fc8732253fce8463150acd4a312cc Mon Sep 17 00:00:00 2001
From: Alx Sa <cmyk.student@gmail.com>
Date: Sun, 28 Jun 2026 12:58:47 +0000
Subject: [PATCH 1/2] plug-ins: Mitigate overflow in FITS import
When allocating memory for importing FITS, it was
possible for the operation to overflow the largest
datatype size, guint32. This patch adds a cast to
gsize for this operation, to reduce the risk of exceeding
the space limit before attempting to allocate.
---
plug-ins/file-fits/fits.c | 14 ++++++++++++--
1 file changed, 12 insertions(+), 2 deletions(-)
diff --git a/plug-ins/file-fits/fits.c b/plug-ins/file-fits/fits.c
index b4a8dbb433..2cd40f1c3f 100644
--- a/plug-ins/file-fits/fits.c
+++ b/plug-ins/file-fits/fits.c
@@ -477,9 +477,19 @@ load_image (GFile *file,
/* If RGB FITS image, we need to read in the whole image so we can convert
* the planes format to RGB */
if (hdu.naxis == 2)
- pixels = (gdouble *) malloc (width * sizeof (gdouble) * channels);
+ pixels = (gdouble *) g_try_malloc ((gsize) width * sizeof (gdouble) *
+ channels);
else
- pixels = (gdouble *) malloc (width * height * sizeof (gdouble) * channels);
+ pixels = (gdouble *) g_try_malloc ((gsize) width * height *
+ sizeof (gdouble) * channels);
+
+ if (pixels == NULL)
+ {
+ g_set_error (error, G_FILE_ERROR, 0,
+ "Memory could not be allocated.");
+ fits_close_file (ifp, &status);
+ return NULL;
+ }
if (! image)
{
From a432acf939384e85c23de67509c9b3f4d4fe43ca Mon Sep 17 00:00:00 2001
From: Alx Sa <cmyk.student@gmail.com>
Date: Wed, 8 Jul 2026 19:29:17 +0000
Subject: [PATCH 2/2] plug-ins: Add more memory checks for FITS imports
As suggested by Michael Catanzaro and Tristan Madani,
this patch adds calls to g_size_checked_mul () to determine
if the requested size for FITS import memory allocation would
overflow in the two places we allocate.
---
plug-ins/file-fits/fits.c | 40 ++++++++++++++++++++++++---------------
1 file changed, 25 insertions(+), 15 deletions(-)
diff --git a/plug-ins/file-fits/fits.c b/plug-ins/file-fits/fits.c
index 2cd40f1c3f..273156c5f8 100644
--- a/plug-ins/file-fits/fits.c
+++ b/plug-ins/file-fits/fits.c
@@ -351,6 +351,7 @@ load_image (GFile *file,
const Babl *type = NULL;
const Babl *format = NULL;
gdouble *pixels;
+ gsize allocate;
gdouble datamin = 1.0E30f;
gdouble datamax = -1.0E30f;
gint channels = 1;
@@ -474,21 +475,18 @@ load_image (GFile *file,
NULL);
}
- /* If RGB FITS image, we need to read in the whole image so we can convert
- * the planes format to RGB */
- if (hdu.naxis == 2)
- pixels = (gdouble *) g_try_malloc ((gsize) width * sizeof (gdouble) *
- channels);
- else
- pixels = (gdouble *) g_try_malloc ((gsize) width * height *
- sizeof (gdouble) * channels);
-
- if (pixels == NULL)
+ /* If RGB FITS image, we need to read in the whole image so we can
+ * convert the planes format to RGB */
+ if (! g_size_checked_mul (&allocate, width, sizeof (gdouble)) ||
+ ! g_size_checked_mul (&allocate, allocate, channels) ||
+ (hdu.naxis > 2 && ! g_size_checked_mul (&allocate, allocate, height)) ||
+ ! (pixels = (gdouble *) g_try_malloc (allocate)))
{
- g_set_error (error, G_FILE_ERROR, 0,
- "Memory could not be allocated.");
+ g_set_error (error, GIMP_PLUG_IN_ERROR, 0,
+ _("There was not enough memory to complete the "
+ "operation."));
fits_close_file (ifp, &status);
- return NULL;
+ return image;
}
if (! image)
@@ -559,8 +557,20 @@ load_image (GFile *file,
if (! status)
{
gdouble *temp;
+ gsize allocate;
- temp = (gdouble *) malloc (width * height * sizeof (gdouble) * channels);
+ if (! g_size_checked_mul (&allocate, width, sizeof (gdouble)) ||
+ ! g_size_checked_mul (&allocate, allocate, channels) ||
+ ! g_size_checked_mul (&allocate, allocate, height) ||
+ ! (temp = (gdouble *) g_try_malloc (allocate)))
+ {
+ g_set_error (error, GIMP_PLUG_IN_ERROR, 0,
+ _("There was not enough memory to complete the "
+ "operation."));
+ fits_close_file (ifp, &status);
+ g_object_unref (buffer);
+ return image;
+ }
if (datamin < datamax)
{
@@ -936,7 +946,7 @@ export_fits (GFile *file,
}
src_offset += width * channelnum;
- offset += width;
+ offset += width;
}
if (export_type == TFLOAT)

166
SOURCES/gimp-CVE-2026-66759.patch Normal file
View File

@ -0,0 +1,166 @@
From f484e007afd332f3f1bde204a92cb87a54cbaa3c Mon Sep 17 00:00:00 2001
From: Alx Sa <cmyk.student@gmail.com>
Date: Tue, 7 Jul 2026 15:54:40 +0000
Subject: [PATCH 1/2] plug-ins: Mitigate OOB write on ICNS mask data
As reported by Tristan, it is possible to create an ICNS
icon with mask data smaller than the icon size. In this case,
our current code could potentially go out of bounds when writing
from file. This patch adds a check to stop executing the code if
we reach the end of the mask data in the file.
---
plug-ins/file-icns/file-icns-load.c | 15 ++++++++++++---
1 file changed, 12 insertions(+), 3 deletions(-)
diff --git a/plug-ins/file-icns/file-icns-load.c b/plug-ins/file-icns/file-icns-load.c
index cd76c710fd..18cd007a39 100644
--- a/plug-ins/file-icns/file-icns-load.c
+++ b/plug-ins/file-icns/file-icns-load.c
@@ -341,7 +341,7 @@ icns_decompress (guchar *dest,
{
if (out > max)
{
- g_message ("Corrupt icon? compressed run overflows output size.");
+ g_message ("Corrupt icon: compressed run overflows output size.");
return FALSE;
}
dest[out++ * 4 + channel] = val;
@@ -387,10 +387,19 @@ icns_decompress (guchar *dest,
else if (mask)
{
gchar typestring[5];
- fourcc_get_string (mask->type, typestring);
+ fourcc_get_string (mask->type, typestring);
for (out = 0; out < max; out++)
- dest[out * 4 + 3] = mask->data[mask->cursor++];
+ {
+ if (mask->cursor >= mask->size)
+ {
+ g_message ("Corrupt icon mask: uncompressed run overflows input "
+ "size.");
+ return FALSE;
+ }
+
+ dest[out * 4 + 3] = mask->data[mask->cursor++];
+ }
}
return TRUE;
}
From 49092ca0ffacae3ae97caba136139f9734c91ac9 Mon Sep 17 00:00:00 2001
From: Alx Sa <cmyk.student@gmail.com>
Date: Tue, 7 Jul 2026 16:49:21 +0000
Subject: [PATCH 2/2] plug-ins: Correct mask loading in ICNS
In some instances, we did checks on and pulled bytes
from the icon data instead of the mask data.
This patch corrects the issue.
In addition, in the unlikely event that GIMP is packaged
on a 32-bit system, we now also guard against an overflow
when allocating IcnsResources.
---
plug-ins/file-icns/file-icns-load.c | 42 ++++++++++++++++++++++-------
1 file changed, 32 insertions(+), 10 deletions(-)
diff --git a/plug-ins/file-icns/file-icns-load.c b/plug-ins/file-icns/file-icns-load.c
index 18cd007a39..fcefefa8f8 100644
--- a/plug-ins/file-icns/file-icns-load.c
+++ b/plug-ins/file-icns/file-icns-load.c
@@ -82,14 +82,17 @@ resource_load (FILE *file)
{
gchar type[5];
guint32 size;
+ gsize allocation;
strncpy (type, header.type, 4);
type[4] = '\0';
size = GUINT32_FROM_BE (header.size);
- if (! strncmp (header.type, "icns", 4) && size > sizeof (IcnsResourceHeader))
+ if (! strncmp (header.type, "icns", 4) &&
+ size > sizeof (IcnsResourceHeader) &&
+ g_size_checked_add (&allocation, sizeof (IcnsResource), size))
{
- res = (IcnsResource *) g_new (guchar, sizeof (IcnsResource) + size);
+ res = (IcnsResource *) g_new (guchar, allocation);
strncpy (res->type, header.type, 4);
res->type[4] = '\0';
res->size = size;
@@ -235,8 +238,8 @@ icns_slurp (guchar *dest,
if (out % 8 == 0)
bucket = icns->data[icns->cursor++];
- bit = (bucket & 0x80) ? 0 : 255;
- bucket = bucket << 1;
+ bit = (bucket & 0x80) ? 0 : 255;
+ bucket = bucket << 1;
dest[out * 4] = bit;
dest[out * 4 + 1] = bit;
dest[out * 4 + 2] = bit;
@@ -250,8 +253,8 @@ icns_slurp (guchar *dest,
if (out % 2 == 0)
bucket = icns->data[icns->cursor++];
- index = 3 * (bucket & 0xf0) >> 4;
- bucket = bucket << 4;
+ index = 3 * (bucket & 0xf0) >> 4;
+ bucket = bucket << 4;
dest[out * 4] = icns_colormap_4[index];
dest[out * 4 + 1] = icns_colormap_4[index + 1];
dest[out * 4 + 2] = icns_colormap_4[index + 2];
@@ -260,7 +263,13 @@ icns_slurp (guchar *dest,
case 8:
for (out = 0; out < max; out++)
{
- index = 3 * icns->data[icns->cursor++];
+ if (icns->cursor >= icns->size)
+ {
+ g_message ("Invalid or corrupt icns resource file.");
+ return;
+ }
+
+ index = 3 * icns->data[icns->cursor++];
dest[out * 4] = icns_colormap_8[index];
dest[out * 4 + 1] = icns_colormap_8[index + 1];
dest[out * 4 + 2] = icns_colormap_8[index + 2];
@@ -270,13 +279,26 @@ icns_slurp (guchar *dest,
case 32:
for (out = 0; out < max; out++)
{
+ if (icns->size < 4 || icns->cursor > icns->size - 4)
+ {
+ g_message ("Invalid or corrupt icns resource file.");
+ return;
+ }
+
dest[out * 4] = icns->data[icns->cursor++];
dest[out * 4 + 1] = icns->data[icns->cursor++];
dest[out * 4 + 2] = icns->data[icns->cursor++];
/* Throw away alpha, use the mask */
icns->cursor++;
+
+ if (mask && mask->cursor >= mask->size)
+ {
+ g_message ("Invalid or corrupt icns resource file.");
+ return;
+ }
+
if (mask)
- dest[out * 4 + 3] = icns->data[mask->cursor++];
+ dest[out * 4 + 3] = mask->data[mask->cursor++];
else
dest[out * 4 + 3] = 255;
}
@@ -292,8 +314,8 @@ icns_slurp (guchar *dest,
if (out % 8 == 0)
bucket = mask->data[mask->cursor++];
- bit = (bucket & 0x80) ? 255 : 0;
- bucket = bucket << 1;
+ bit = (bucket & 0x80) ? 255 : 0;
+ bucket = bucket << 1;
dest[out * 4 + 3] = bit;
}
}

25
SPECS/gimp.spec
View File

@ -67,7 +67,7 @@ Name: gimp
Epoch: 2
Version: 3.0.4
%global rel 4
Release: %{rel}%{?dist}.7
Release: %{rel}%{?dist}.9
# https://bugzilla.redhat.com/show_bug.cgi?id=2318369
ExcludeArch: s390x
@ -277,6 +277,15 @@ Patch21: gimp-CVE-2026-58379.patch
Patch22: gimp-CVE-2026-58384.patch
# https://gitlab.gnome.org/GNOME/gimp/-/commit/83699817
Patch23: gimp-CVE-2026-58380.patch
# https://gitlab.gnome.org/GNOME/gimp/-/commit/abb3129a8ecb
# https://gitlab.gnome.org/GNOME/gimp/-/commit/41ef331896882
Patch24: gimp-CVE-2026-66759.patch
# https://gitlab.gnome.org/GNOME/gimp/-/commit/b01d06315352b56928625e480dd22b3876721e2c
# https://gitlab.gnome.org/GNOME/gimp/-/commit/bcde5da5e350c9c6100a579ba2b762e007c78150
Patch25: gimp-CVE-2026-66758.patch
# https://gitlab.gnome.org/GNOME/gimp/-/commit/691785113a
# https://gitlab.gnome.org/GNOME/gimp/-/commit/7dff816fbd
Patch26: gimp-CVE-2026-42169.patch
# use external help browser directly if help browser plug-in is not built
Patch100: gimp-3.0.2-external-help-browser.patch
@ -372,6 +381,9 @@ EOF
%patch21 -p1 -b .CVE-2026-58379
%patch22 -p1 -b .CVE-2026-58384
%patch23 -p1 -b .CVE-2026-58380
%patch24 -p1 -b .CVE-2026-66759
%patch25 -p1 -b .CVE-2026-66758
%patch26 -p1 -b .CVE-2026-42169
%patch100 -p1 -b .external-help-browser
@ -687,6 +699,17 @@ done
%endif
%changelog
* Tue Aug 04 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 2:3.0.4-4.9
- fix CVE-2026-42169
* Tue Jul 28 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 2:3.0.4-4.8
- fix CVE-2026-66758
- fix CVE-2026-66759
* Mon Jul 13 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 2:3.0.4-4.7
- fix CVE-2026-58380
- Resolves: RHEL-192383
* Fri Jul 10 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 2:3.0.4-4.6
- fix CVE-2026-58384
- Resolves: RHEL-192536