rpms/gimp
7
0
Fork 0
Code Issues Pull Requests Releases Activity

import CS git gimp-2.8.22-26.el8.8

Browse Source
This commit is contained in:
AlmaLinux RelEng Bot 2026-09-02 05:16:22 -04:00
parent 18afbd8460
commit b62daec708
10 changed files with 368 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

45
SOURCES/gimp-CVE-2026-18301.patch Normal file
View File

@ -0,0 +1,45 @@
--- a/plug-ins/file-psd/psd-load.c 2026-08-24 18:04:09.590696953 +0200
+++ b/plug-ins/file-psd/psd-load.c 2026-08-24 18:04:33.218984673 +0200
@@ -1897,26 +1897,35 @@ read_channel_data (PSDchannel *chann
gchar *raw_data;
gchar *src;
gchar *dst;
- guint32 readline_len;
+ gsize readline_len;
+ gsize allocation;
if (bps == 1)
- readline_len = ((channel->columns + 7) >> 3);
+ readline_len = (gsize) ((channel->columns + 7) >> 3);
else
- readline_len = (channel->columns * bps >> 3);
+ readline_len = (gsize) (channel->columns * bps >> 3);
- IFDBG(3) g_debug ("raw data size %d x %d = %d", readline_len,
+ IFDBG(3) g_debug ("raw data size %" G_GSIZE_FORMAT " x %d = %" G_GSIZE_FORMAT,
+ readline_len,
channel->rows, readline_len * channel->rows);
/* sanity check, int overflow check (avoid divisions by zero) */
- if ((channel->rows == 0) || (channel->columns == 0) ||
- (channel->rows > G_MAXINT32 / channel->columns / MAX (bps >> 3, 1)))
+ if ((channel->rows == 0) || (channel->columns == 0) ||
+ (channel->rows >= G_MAXINT32 / channel->columns / MAX (bps >> 3, 1)) ||
+ ! g_size_checked_mul (&allocation, readline_len, channel->rows))
{
g_set_error (error, G_FILE_ERROR, G_FILE_ERROR_FAILED,
_("Unsupported or invalid channel size"));
return -1;
}
- raw_data = g_malloc (readline_len * channel->rows);
+ raw_data = g_try_malloc (allocation);
+ if (raw_data == NULL)
+ {
+ g_set_error (error, G_FILE_ERROR, G_FILE_ERROR_FAILED,
+ _("Not enough memory to load channel data."));
+ return -1;
+ }
switch (compression)
{
case PSD_COMP_RAW:

16
SOURCES/gimp-CVE-2026-18303.patch Normal file
View File

@ -0,0 +1,16 @@
--- a/plug-ins/common/file-tiff-load.c 2026-08-24 18:09:17.583649704 +0200
+++ b/plug-ins/common/file-tiff-load.c 2026-08-24 18:09:25.931442732 +0200
@@ -970,6 +970,13 @@ load_image (const gchar *filename
}
else
{
+ if (bps > 8)
+ {
+ g_message (_("Indexed TIFFs with color maps larger than 256 "
+ "colors are not yet supported"));
+ return -1;
+ }
+
if (!TIFFGetField (tif, TIFFTAG_COLORMAP,
&redmap, &greenmap, &bluemap))
{

107
SOURCES/gimp-CVE-2026-18304.patch Normal file
View File

@ -0,0 +1,107 @@
--- a/plug-ins/common/file-tiff-load.c 2026-08-24 18:31:12.861878726 +0200
+++ b/plug-ins/common/file-tiff-load.c 2026-08-24 18:31:51.310484335 +0200
@@ -1443,6 +1443,7 @@ load_tiles (TIFF *tif,
guchar *buffer;
gdouble progress = 0.0, one_row;
gint i;
+ gsize tile_area;
TIFFGetField (tif, TIFFTAG_PLANARCONFIG, &planar);
TIFFGetField (tif, TIFFTAG_IMAGEWIDTH, &imageWidth);
@@ -1459,11 +1460,32 @@ load_tiles (TIFF *tif,
one_row = (gdouble) tileLength / (gdouble) imageLength;
buffer = g_malloc (TIFFTileSize (tif));
+ if (! g_size_checked_mul (&tile_area, (gsize) tileWidth, tileLength))
+ {
+ g_message (_("Not enough memory to load TIFF image."));
+ g_free (buffer);
+ return;
+ }
+
for (i = 0; i <= extra; ++i)
{
- channel[i].pixels = g_new (guchar,
- tileWidth * tileLength *
- channel[i].drawable->bpp);
+ gsize pixels_size;
+
+ if (! g_size_checked_mul (&pixels_size, tile_area,
+ channel[i].drawable->bpp))
+ {
+ g_message (_("Not enough memory to load TIFF image."));
+ g_free (buffer);
+ return;
+ }
+
+ channel[i].pixels = g_try_malloc (pixels_size);
+ if (channel[i].pixels == NULL)
+ {
+ g_message (_("Not enough memory to load TIFF image."));
+ g_free (buffer);
+ return;
+ }
}
for (y = 0; y < imageLength; y += tileLength)
@@ -1522,6 +1544,7 @@ load_lines (TIFF *tif,
guchar *buffer;
gint i, y;
gint tile_height = gimp_tile_height ();
+ gsize pixels_area;
TIFFGetField (tif, TIFFTAG_PLANARCONFIG, &planar);
TIFFGetField (tif, TIFFTAG_IMAGELENGTH, &imageLength);
@@ -1529,15 +1552,49 @@ load_lines (TIFF *tif,
lineSize = TIFFScanlineSize (tif);
+ if (! g_size_checked_mul (&pixels_area, (gsize) tile_height, cols))
+ {
+ g_message (_("Not enough memory to load TIFF image."));
+ return;
+ }
+
for (i = 0; i <= extra; ++i)
{
- channel[i].pixels = g_new (guchar,
- tile_height * cols * channel[i].drawable->bpp);
+ gsize pixels_size;
+
+ if (! g_size_checked_mul (&pixels_size, pixels_area,
+ channel[i].drawable->bpp))
+ {
+ g_message (_("Not enough memory to load TIFF image."));
+ return;
+ }
+
+ channel[i].pixels = g_try_malloc (pixels_size);
+ if (channel[i].pixels == NULL)
+ {
+ g_message (_("Not enough memory to load TIFF image."));
+ return;
+ }
}
gimp_tile_cache_ntiles (1 + cols / gimp_tile_width ());
- buffer = g_malloc (lineSize * tile_height);
+ {
+ gsize buf_size;
+
+ if (! g_size_checked_mul (&buf_size, (gsize) lineSize, tile_height))
+ {
+ g_message (_("Not enough memory to load TIFF image."));
+ return;
+ }
+
+ buffer = g_try_malloc (buf_size);
+ if (buffer == NULL)
+ {
+ g_message (_("Not enough memory to load TIFF image."));
+ return;
+ }
+ }
if (planar == PLANARCONFIG_CONTIG)
{

33
SOURCES/gimp-CVE-2026-18305.patch Normal file
View File

@ -0,0 +1,33 @@
--- a/plug-ins/common/file-tiff-load.c 2026-08-24 18:11:53.484324374 +0200
+++ b/plug-ins/common/file-tiff-load.c 2026-08-24 18:12:04.101038727 +0200
@@ -1189,16 +1189,29 @@ load_rgba (TIFF *tif,
uint32 imageWidth, imageLength;
uint32 row;
uint32 *buffer;
+ gsize allocation;
TIFFGetField (tif, TIFFTAG_IMAGEWIDTH, &imageWidth);
TIFFGetField (tif, TIFFTAG_IMAGELENGTH, &imageLength);
+ if (! g_size_checked_mul (&allocation, imageWidth, imageLength) ||
+ ! g_size_checked_mul (&allocation, allocation, sizeof (uint32)))
+ {
+ g_message (_("Not enough memory to load TIFF image."));
+ return;
+ }
+
gimp_tile_cache_ntiles (1 + imageWidth / gimp_tile_width ());
gimp_pixel_rgn_init (&(channel[0].pixel_rgn), channel[0].drawable,
0, 0, imageWidth, imageLength, TRUE, FALSE);
- buffer = g_new (uint32, imageWidth * imageLength);
+ buffer = g_try_malloc0 (allocation);
+ if (buffer == NULL)
+ {
+ g_message (_("Not enough memory to load TIFF image."));
+ return;
+ }
channel[0].pixels = (guchar *) buffer;
if (!TIFFReadRGBAImage (tif, imageWidth, imageLength, buffer, 0))

15
SOURCES/gimp-CVE-2026-18306.patch Normal file
View File

@ -0,0 +1,15 @@
--- a/plug-ins/file-sgi/sgi-lib.c 2026-08-24 18:13:30.362855152 +0200
+++ b/plug-ins/file-sgi/sgi-lib.c 2026-08-24 18:13:39.424184421 +0200
@@ -317,6 +317,12 @@ sgiOpenFile(FILE *file, /* I - File to o
sgip->comp = getc(sgip->file);
sgip->bpp = getc(sgip->file);
+ if (sgip->bpp > 2)
+ {
+ free (sgip);
+ return (NULL);
+ }
+
getshort(sgip); /* Dimensions */
sgip->xsize = getshort(sgip);
sgip->ysize = getshort(sgip);

13
SOURCES/gimp-CVE-2026-18307.patch Normal file
View File

@ -0,0 +1,13 @@
--- a/plug-ins/common/file-tiff-load.c 2026-08-24 18:34:32.533753538 +0200
+++ b/plug-ins/common/file-tiff-load.c 2026-08-24 18:34:41.340017657 +0200
@@ -748,6 +748,10 @@ load_image (const gchar *filename
break;
}
+ if ((photomet == PHOTOMETRIC_RGB && spp < 3) ||
+ (photomet != PHOTOMETRIC_RGB && spp < 1))
+ worst_case = TRUE;
+
/* attach a parasite containing the compression */
if (!TIFFGetField (tif, TIFFTAG_COMPRESSION, &tmp))
{

32
SOURCES/gimp-CVE-2026-58380.patch Normal file
View File

@ -0,0 +1,32 @@
From 8369981756fc2742226b79296fd1886156001d94 Mon Sep 17 00:00:00 2001
From: Alx Sa <cmyk.student@gmail.com>
Date: Sat, 11 Apr 2026 14:33:42 +0000
Subject: [PATCH] plug-ins: Boost buffer size for pnmscanner_gettoken
Resolves #16206
pnmscanner_gettoken () in file-pnm assumes that the
buffer it receives is larger than its bufsize parameter.
In almost all cases this is true, except in pnm_load_ascii ().
This patch adds the + 4 that is used everywhere else to ensure
we don't have an issue with buffer overflow.
---
plug-ins/common/file-pnm.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/plug-ins/common/file-pnm.c b/plug-ins/common/file-pnm.c
index 65619be59de..81d73c14507 100644
--- a/plug-ins/common/file-pnm.c
+++ b/plug-ins/common/file-pnm.c
@@ -958,7 +958,7 @@ pnm_load_ascii (PNMScanner *scan,
gint x, y, i, b;
gint start, end, scanlines;
gint np;
- gchar buf[BUFLEN];
+ gchar buf[BUFLEN + 4];
gboolean aborted = FALSE;
np = (info->np) ? (info->np) : 1;
--
GitLab

41
SOURCES/gimp-CVE-2026-59090.patch Normal file
View File

@ -0,0 +1,41 @@
--- a/plug-ins/file-psd/psd-load.c 2026-08-24 18:00:21.220989439 +0200
+++ b/plug-ins/file-psd/psd-load.c 2026-08-24 18:01:26.941602351 +0200
@@ -655,6 +655,12 @@ read_layer_block (PSDimage *img_a,
return NULL;
}
block_len = GUINT32_FROM_BE (block_len);
+ if (block_len + 4 > block_rem)
+ {
+ g_set_error (error, G_FILE_ERROR, G_FILE_ERROR_FAILED,
+ _("Invalid block size."));
+ return NULL;
+ }
block_rem -= (block_len + 4);
IFDBG(3) g_debug ("Remaining length %d", block_rem);
@@ -801,6 +807,12 @@ read_layer_block (PSDimage *img_a,
return NULL;
}
block_len = GUINT32_FROM_BE (block_len);
+ if (block_len + 4 > block_rem)
+ {
+ g_set_error (error, G_FILE_ERROR, G_FILE_ERROR_FAILED,
+ _("Invalid block size."));
+ return NULL;
+ }
block_rem -= (block_len + 4);
IFDBG(3) g_debug ("Remaining length %d", block_rem);
if (block_len > 0)
@@ -816,6 +828,12 @@ read_layer_block (PSDimage *img_a,
4, f, error);
if (*error)
return NULL;
+ if (read_len > block_rem)
+ {
+ g_set_error (error, G_FILE_ERROR, G_FILE_ERROR_FAILED,
+ _("Invalid block size."));
+ return NULL;
+ }
block_rem -= read_len;
IFDBG(3) g_debug ("Remaining length %d", block_rem);

34
SOURCES/gimp-CVE-2026-66758.patch Normal file
View File

@ -0,0 +1,34 @@
--- a/plug-ins/file-fits/fits.c 2026-08-24 18:28:05.962315725 +0200
+++ b/plug-ins/file-fits/fits.c 2026-08-24 18:28:21.868290850 +0200
@@ -561,6 +561,7 @@ load_fits (const gchar *filename,
GimpImageBaseType itype;
GimpImageType dtype;
gint err = 0;
+ gsize allocate;
FITS_HDU_LIST *hdulist;
FITS_PIX_TRANSFORM trans;
@@ -579,9 +580,20 @@ load_fits (const gchar *filename,
&layer_ID, &drawable, &pixel_rgn);
tile_height = gimp_tile_height ();
- data = g_malloc (tile_height * width * ncompose);
- if (data == NULL) return (-1);
- data_end = data + tile_height * width * ncompose;
+ if (! g_size_checked_mul (&allocate, (gsize) tile_height, width) ||
+ ! g_size_checked_mul (&allocate, allocate, ncompose))
+ {
+ g_message (_("Not enough memory to load FITS image."));
+ return (-1);
+ }
+
+ data = g_try_malloc (allocate);
+ if (data == NULL)
+ {
+ g_message (_("Not enough memory to load FITS image."));
+ return (-1);
+ }
+ data_end = data + allocate;
/* If the transformation from pixel value to */
/* data value has been specified, use it */

33
SPECS/gimp.spec
View File

@ -75,7 +75,7 @@ Summary: GNU Image Manipulation Program
Name: gimp
Epoch: 2
Version: 2.8.22
Release: %{?prerelprefix}26%{dotprerel}%{dotgitrev}%{?dist}.6
Release: %{?prerelprefix}26%{dotprerel}%{dotgitrev}%{?dist}.8
# Compute some version related macros.
# Ugly, need to get quoting percent signs straight.
@ -230,6 +230,15 @@ Patch26: gimp-CVE-2026-4150.patch
Patch27: gimp-CVE-2026-4153.patch
Patch28: gimp-CVE-2026-4154.patch
Patch29: gimp-CVE-2026-4887.patch
Patch30: gimp-CVE-2026-58380.patch
Patch31: gimp-CVE-2026-59090.patch
Patch32: gimp-CVE-2026-18301.patch
Patch33: gimp-CVE-2026-18303.patch
Patch34: gimp-CVE-2026-18305.patch
Patch35: gimp-CVE-2026-18306.patch
Patch36: gimp-CVE-2026-66758.patch
Patch37: gimp-CVE-2026-18304.patch
Patch38: gimp-CVE-2026-18307.patch
# use external help browser directly if help browser plug-in is not built
Patch100: gimp-2.8.6-external-help-browser.patch
@ -343,6 +352,15 @@ EOF
%patch27 -p1 -b .CVE-2026-4153
%patch28 -p1 -b .CVE-2026-4154
%patch29 -p1 -b .CVE-2026-4887
%patch30 -p1 -b .CVE-2026-58380
%patch31 -p1 -b .CVE-2026-59090
%patch32 -p1 -b .CVE-2026-18301
%patch33 -p1 -b .CVE-2026-18303
%patch34 -p1 -b .CVE-2026-18305
%patch35 -p1 -b .CVE-2026-18306
%patch36 -p1 -b .CVE-2026-66758
%patch37 -p1 -b .CVE-2026-18304
%patch38 -p1 -b .CVE-2026-18307
%if ! %{with helpbrowser}
%patch100 -p1 -b .external-help-browser
%endif
@ -681,6 +699,19 @@ make check
%endif
%changelog
* Mon Aug 24 2026 Josef Ridky <jridky@redhat.com> - 2:2.8.22-26.8
- fix CVE-2026-59090
- fix CVE-2026-18301
- fix CVE-2026-18303
- fix CVE-2026-18305
- fix CVE-2026-18306
- fix CVE-2026-66758
- fix CVE-2026-18304
- fix CVE-2026-18307
* Thu Aug 06 2026 Josef Ridky <jridky@redhat.com> - 2:2.8.22-26.7
- fix CVE-2026-58380
* Tue May 12 2026 Josef Ridky <jridky@redhat.com> - 2:2.8.22-26.6
- fix CVE-2026-4150
- fix CVE-2026-4153