From b62daec708835a3301d1643cb3831050fb7e768f Mon Sep 17 00:00:00 2001 From: AlmaLinux RelEng Bot Date: Wed, 2 Sep 2026 05:16:22 -0400 Subject: [PATCH] import CS git gimp-2.8.22-26.el8.8 --- SOURCES/gimp-CVE-2026-18301.patch | 45 +++++++++++++ SOURCES/gimp-CVE-2026-18303.patch | 16 +++++ SOURCES/gimp-CVE-2026-18304.patch | 107 ++++++++++++++++++++++++++++++ SOURCES/gimp-CVE-2026-18305.patch | 33 +++++++++ SOURCES/gimp-CVE-2026-18306.patch | 15 +++++ SOURCES/gimp-CVE-2026-18307.patch | 13 ++++ SOURCES/gimp-CVE-2026-58380.patch | 32 +++++++++ SOURCES/gimp-CVE-2026-59090.patch | 41 ++++++++++++ SOURCES/gimp-CVE-2026-66758.patch | 34 ++++++++++ SPECS/gimp.spec | 33 ++++++++- 10 files changed, 368 insertions(+), 1 deletion(-) create mode 100644 SOURCES/gimp-CVE-2026-18301.patch create mode 100644 SOURCES/gimp-CVE-2026-18303.patch create mode 100644 SOURCES/gimp-CVE-2026-18304.patch create mode 100644 SOURCES/gimp-CVE-2026-18305.patch create mode 100644 SOURCES/gimp-CVE-2026-18306.patch create mode 100644 SOURCES/gimp-CVE-2026-18307.patch create mode 100644 SOURCES/gimp-CVE-2026-58380.patch create mode 100644 SOURCES/gimp-CVE-2026-59090.patch create mode 100644 SOURCES/gimp-CVE-2026-66758.patch diff --git a/SOURCES/gimp-CVE-2026-18301.patch b/SOURCES/gimp-CVE-2026-18301.patch new file mode 100644 index 0000000..f0403a0 --- /dev/null +++ b/SOURCES/gimp-CVE-2026-18301.patch @@ -0,0 +1,45 @@ +--- a/plug-ins/file-psd/psd-load.c 2026-08-24 18:04:09.590696953 +0200 ++++ b/plug-ins/file-psd/psd-load.c 2026-08-24 18:04:33.218984673 +0200 +@@ -1897,26 +1897,35 @@ read_channel_data (PSDchannel *chann + gchar *raw_data; + gchar *src; + gchar *dst; +- guint32 readline_len; ++ gsize readline_len; ++ gsize allocation; + + if (bps == 1) +- readline_len = ((channel->columns + 7) >> 3); ++ readline_len = (gsize) ((channel->columns + 7) >> 3); + else +- readline_len = (channel->columns * bps >> 3); ++ readline_len = (gsize) (channel->columns * bps >> 3); + +- IFDBG(3) g_debug ("raw data size %d x %d = %d", readline_len, ++ IFDBG(3) g_debug ("raw data size %" G_GSIZE_FORMAT " x %d = %" G_GSIZE_FORMAT, ++ readline_len, + channel->rows, readline_len * channel->rows); + + /* sanity check, int overflow check (avoid divisions by zero) */ +- if ((channel->rows == 0) || (channel->columns == 0) || +- (channel->rows > G_MAXINT32 / channel->columns / MAX (bps >> 3, 1))) ++ if ((channel->rows == 0) || (channel->columns == 0) || ++ (channel->rows >= G_MAXINT32 / channel->columns / MAX (bps >> 3, 1)) || ++ ! g_size_checked_mul (&allocation, readline_len, channel->rows)) + { + g_set_error (error, G_FILE_ERROR, G_FILE_ERROR_FAILED, + _("Unsupported or invalid channel size")); + return -1; + } + +- raw_data = g_malloc (readline_len * channel->rows); ++ raw_data = g_try_malloc (allocation); ++ if (raw_data == NULL) ++ { ++ g_set_error (error, G_FILE_ERROR, G_FILE_ERROR_FAILED, ++ _("Not enough memory to load channel data.")); ++ return -1; ++ } + switch (compression) + { + case PSD_COMP_RAW: diff --git a/SOURCES/gimp-CVE-2026-18303.patch b/SOURCES/gimp-CVE-2026-18303.patch new file mode 100644 index 0000000..4abd1b8 --- /dev/null +++ b/SOURCES/gimp-CVE-2026-18303.patch @@ -0,0 +1,16 @@ +--- a/plug-ins/common/file-tiff-load.c 2026-08-24 18:09:17.583649704 +0200 ++++ b/plug-ins/common/file-tiff-load.c 2026-08-24 18:09:25.931442732 +0200 +@@ -970,6 +970,13 @@ load_image (const gchar *filename + } + else + { ++ if (bps > 8) ++ { ++ g_message (_("Indexed TIFFs with color maps larger than 256 " ++ "colors are not yet supported")); ++ return -1; ++ } ++ + if (!TIFFGetField (tif, TIFFTAG_COLORMAP, + &redmap, &greenmap, &bluemap)) + { diff --git a/SOURCES/gimp-CVE-2026-18304.patch b/SOURCES/gimp-CVE-2026-18304.patch new file mode 100644 index 0000000..79d8b65 --- /dev/null +++ b/SOURCES/gimp-CVE-2026-18304.patch @@ -0,0 +1,107 @@ +--- a/plug-ins/common/file-tiff-load.c 2026-08-24 18:31:12.861878726 +0200 ++++ b/plug-ins/common/file-tiff-load.c 2026-08-24 18:31:51.310484335 +0200 +@@ -1443,6 +1443,7 @@ load_tiles (TIFF *tif, + guchar *buffer; + gdouble progress = 0.0, one_row; + gint i; ++ gsize tile_area; + + TIFFGetField (tif, TIFFTAG_PLANARCONFIG, &planar); + TIFFGetField (tif, TIFFTAG_IMAGEWIDTH, &imageWidth); +@@ -1459,11 +1460,32 @@ load_tiles (TIFF *tif, + one_row = (gdouble) tileLength / (gdouble) imageLength; + buffer = g_malloc (TIFFTileSize (tif)); + ++ if (! g_size_checked_mul (&tile_area, (gsize) tileWidth, tileLength)) ++ { ++ g_message (_("Not enough memory to load TIFF image.")); ++ g_free (buffer); ++ return; ++ } ++ + for (i = 0; i <= extra; ++i) + { +- channel[i].pixels = g_new (guchar, +- tileWidth * tileLength * +- channel[i].drawable->bpp); ++ gsize pixels_size; ++ ++ if (! g_size_checked_mul (&pixels_size, tile_area, ++ channel[i].drawable->bpp)) ++ { ++ g_message (_("Not enough memory to load TIFF image.")); ++ g_free (buffer); ++ return; ++ } ++ ++ channel[i].pixels = g_try_malloc (pixels_size); ++ if (channel[i].pixels == NULL) ++ { ++ g_message (_("Not enough memory to load TIFF image.")); ++ g_free (buffer); ++ return; ++ } + } + + for (y = 0; y < imageLength; y += tileLength) +@@ -1522,6 +1544,7 @@ load_lines (TIFF *tif, + guchar *buffer; + gint i, y; + gint tile_height = gimp_tile_height (); ++ gsize pixels_area; + + TIFFGetField (tif, TIFFTAG_PLANARCONFIG, &planar); + TIFFGetField (tif, TIFFTAG_IMAGELENGTH, &imageLength); +@@ -1529,15 +1552,49 @@ load_lines (TIFF *tif, + + lineSize = TIFFScanlineSize (tif); + ++ if (! g_size_checked_mul (&pixels_area, (gsize) tile_height, cols)) ++ { ++ g_message (_("Not enough memory to load TIFF image.")); ++ return; ++ } ++ + for (i = 0; i <= extra; ++i) + { +- channel[i].pixels = g_new (guchar, +- tile_height * cols * channel[i].drawable->bpp); ++ gsize pixels_size; ++ ++ if (! g_size_checked_mul (&pixels_size, pixels_area, ++ channel[i].drawable->bpp)) ++ { ++ g_message (_("Not enough memory to load TIFF image.")); ++ return; ++ } ++ ++ channel[i].pixels = g_try_malloc (pixels_size); ++ if (channel[i].pixels == NULL) ++ { ++ g_message (_("Not enough memory to load TIFF image.")); ++ return; ++ } + } + + gimp_tile_cache_ntiles (1 + cols / gimp_tile_width ()); + +- buffer = g_malloc (lineSize * tile_height); ++ { ++ gsize buf_size; ++ ++ if (! g_size_checked_mul (&buf_size, (gsize) lineSize, tile_height)) ++ { ++ g_message (_("Not enough memory to load TIFF image.")); ++ return; ++ } ++ ++ buffer = g_try_malloc (buf_size); ++ if (buffer == NULL) ++ { ++ g_message (_("Not enough memory to load TIFF image.")); ++ return; ++ } ++ } + + if (planar == PLANARCONFIG_CONTIG) + { diff --git a/SOURCES/gimp-CVE-2026-18305.patch b/SOURCES/gimp-CVE-2026-18305.patch new file mode 100644 index 0000000..5387f09 --- /dev/null +++ b/SOURCES/gimp-CVE-2026-18305.patch @@ -0,0 +1,33 @@ +--- a/plug-ins/common/file-tiff-load.c 2026-08-24 18:11:53.484324374 +0200 ++++ b/plug-ins/common/file-tiff-load.c 2026-08-24 18:12:04.101038727 +0200 +@@ -1189,16 +1189,29 @@ load_rgba (TIFF *tif, + uint32 imageWidth, imageLength; + uint32 row; + uint32 *buffer; ++ gsize allocation; + + TIFFGetField (tif, TIFFTAG_IMAGEWIDTH, &imageWidth); + TIFFGetField (tif, TIFFTAG_IMAGELENGTH, &imageLength); + ++ if (! g_size_checked_mul (&allocation, imageWidth, imageLength) || ++ ! g_size_checked_mul (&allocation, allocation, sizeof (uint32))) ++ { ++ g_message (_("Not enough memory to load TIFF image.")); ++ return; ++ } ++ + gimp_tile_cache_ntiles (1 + imageWidth / gimp_tile_width ()); + + gimp_pixel_rgn_init (&(channel[0].pixel_rgn), channel[0].drawable, + 0, 0, imageWidth, imageLength, TRUE, FALSE); + +- buffer = g_new (uint32, imageWidth * imageLength); ++ buffer = g_try_malloc0 (allocation); ++ if (buffer == NULL) ++ { ++ g_message (_("Not enough memory to load TIFF image.")); ++ return; ++ } + channel[0].pixels = (guchar *) buffer; + + if (!TIFFReadRGBAImage (tif, imageWidth, imageLength, buffer, 0)) diff --git a/SOURCES/gimp-CVE-2026-18306.patch b/SOURCES/gimp-CVE-2026-18306.patch new file mode 100644 index 0000000..e256a6b --- /dev/null +++ b/SOURCES/gimp-CVE-2026-18306.patch @@ -0,0 +1,15 @@ +--- a/plug-ins/file-sgi/sgi-lib.c 2026-08-24 18:13:30.362855152 +0200 ++++ b/plug-ins/file-sgi/sgi-lib.c 2026-08-24 18:13:39.424184421 +0200 +@@ -317,6 +317,12 @@ sgiOpenFile(FILE *file, /* I - File to o + + sgip->comp = getc(sgip->file); + sgip->bpp = getc(sgip->file); ++ if (sgip->bpp > 2) ++ { ++ free (sgip); ++ return (NULL); ++ } ++ + getshort(sgip); /* Dimensions */ + sgip->xsize = getshort(sgip); + sgip->ysize = getshort(sgip); diff --git a/SOURCES/gimp-CVE-2026-18307.patch b/SOURCES/gimp-CVE-2026-18307.patch new file mode 100644 index 0000000..5088fdb --- /dev/null +++ b/SOURCES/gimp-CVE-2026-18307.patch @@ -0,0 +1,13 @@ +--- a/plug-ins/common/file-tiff-load.c 2026-08-24 18:34:32.533753538 +0200 ++++ b/plug-ins/common/file-tiff-load.c 2026-08-24 18:34:41.340017657 +0200 +@@ -748,6 +748,10 @@ load_image (const gchar *filename + break; + } + ++ if ((photomet == PHOTOMETRIC_RGB && spp < 3) || ++ (photomet != PHOTOMETRIC_RGB && spp < 1)) ++ worst_case = TRUE; ++ + /* attach a parasite containing the compression */ + if (!TIFFGetField (tif, TIFFTAG_COMPRESSION, &tmp)) + { diff --git a/SOURCES/gimp-CVE-2026-58380.patch b/SOURCES/gimp-CVE-2026-58380.patch new file mode 100644 index 0000000..1098be9 --- /dev/null +++ b/SOURCES/gimp-CVE-2026-58380.patch @@ -0,0 +1,32 @@ +From 8369981756fc2742226b79296fd1886156001d94 Mon Sep 17 00:00:00 2001 +From: Alx Sa +Date: Sat, 11 Apr 2026 14:33:42 +0000 +Subject: [PATCH] plug-ins: Boost buffer size for pnmscanner_gettoken + +Resolves #16206 +pnmscanner_gettoken () in file-pnm assumes that the +buffer it receives is larger than its bufsize parameter. +In almost all cases this is true, except in pnm_load_ascii (). +This patch adds the + 4 that is used everywhere else to ensure +we don't have an issue with buffer overflow. +--- + plug-ins/common/file-pnm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/plug-ins/common/file-pnm.c b/plug-ins/common/file-pnm.c +index 65619be59de..81d73c14507 100644 +--- a/plug-ins/common/file-pnm.c ++++ b/plug-ins/common/file-pnm.c +@@ -958,7 +958,7 @@ pnm_load_ascii (PNMScanner *scan, + gint x, y, i, b; + gint start, end, scanlines; + gint np; +- gchar buf[BUFLEN]; ++ gchar buf[BUFLEN + 4]; + gboolean aborted = FALSE; + + np = (info->np) ? (info->np) : 1; +-- +GitLab + + diff --git a/SOURCES/gimp-CVE-2026-59090.patch b/SOURCES/gimp-CVE-2026-59090.patch new file mode 100644 index 0000000..a342952 --- /dev/null +++ b/SOURCES/gimp-CVE-2026-59090.patch @@ -0,0 +1,41 @@ +--- a/plug-ins/file-psd/psd-load.c 2026-08-24 18:00:21.220989439 +0200 ++++ b/plug-ins/file-psd/psd-load.c 2026-08-24 18:01:26.941602351 +0200 +@@ -655,6 +655,12 @@ read_layer_block (PSDimage *img_a, + return NULL; + } + block_len = GUINT32_FROM_BE (block_len); ++ if (block_len + 4 > block_rem) ++ { ++ g_set_error (error, G_FILE_ERROR, G_FILE_ERROR_FAILED, ++ _("Invalid block size.")); ++ return NULL; ++ } + block_rem -= (block_len + 4); + IFDBG(3) g_debug ("Remaining length %d", block_rem); + +@@ -801,6 +807,12 @@ read_layer_block (PSDimage *img_a, + return NULL; + } + block_len = GUINT32_FROM_BE (block_len); ++ if (block_len + 4 > block_rem) ++ { ++ g_set_error (error, G_FILE_ERROR, G_FILE_ERROR_FAILED, ++ _("Invalid block size.")); ++ return NULL; ++ } + block_rem -= (block_len + 4); + IFDBG(3) g_debug ("Remaining length %d", block_rem); + if (block_len > 0) +@@ -816,6 +828,12 @@ read_layer_block (PSDimage *img_a, + 4, f, error); + if (*error) + return NULL; ++ if (read_len > block_rem) ++ { ++ g_set_error (error, G_FILE_ERROR, G_FILE_ERROR_FAILED, ++ _("Invalid block size.")); ++ return NULL; ++ } + block_rem -= read_len; + IFDBG(3) g_debug ("Remaining length %d", block_rem); + diff --git a/SOURCES/gimp-CVE-2026-66758.patch b/SOURCES/gimp-CVE-2026-66758.patch new file mode 100644 index 0000000..c4de5d7 --- /dev/null +++ b/SOURCES/gimp-CVE-2026-66758.patch @@ -0,0 +1,34 @@ +--- a/plug-ins/file-fits/fits.c 2026-08-24 18:28:05.962315725 +0200 ++++ b/plug-ins/file-fits/fits.c 2026-08-24 18:28:21.868290850 +0200 +@@ -561,6 +561,7 @@ load_fits (const gchar *filename, + GimpImageBaseType itype; + GimpImageType dtype; + gint err = 0; ++ gsize allocate; + FITS_HDU_LIST *hdulist; + FITS_PIX_TRANSFORM trans; + +@@ -579,9 +580,20 @@ load_fits (const gchar *filename, + &layer_ID, &drawable, &pixel_rgn); + + tile_height = gimp_tile_height (); +- data = g_malloc (tile_height * width * ncompose); +- if (data == NULL) return (-1); +- data_end = data + tile_height * width * ncompose; ++ if (! g_size_checked_mul (&allocate, (gsize) tile_height, width) || ++ ! g_size_checked_mul (&allocate, allocate, ncompose)) ++ { ++ g_message (_("Not enough memory to load FITS image.")); ++ return (-1); ++ } ++ ++ data = g_try_malloc (allocate); ++ if (data == NULL) ++ { ++ g_message (_("Not enough memory to load FITS image.")); ++ return (-1); ++ } ++ data_end = data + allocate; + + /* If the transformation from pixel value to */ + /* data value has been specified, use it */ diff --git a/SPECS/gimp.spec b/SPECS/gimp.spec index 185e98d..392bf0c 100644 --- a/SPECS/gimp.spec +++ b/SPECS/gimp.spec @@ -75,7 +75,7 @@ Summary: GNU Image Manipulation Program Name: gimp Epoch: 2 Version: 2.8.22 -Release: %{?prerelprefix}26%{dotprerel}%{dotgitrev}%{?dist}.6 +Release: %{?prerelprefix}26%{dotprerel}%{dotgitrev}%{?dist}.8 # Compute some version related macros. # Ugly, need to get quoting percent signs straight. @@ -230,6 +230,15 @@ Patch26: gimp-CVE-2026-4150.patch Patch27: gimp-CVE-2026-4153.patch Patch28: gimp-CVE-2026-4154.patch Patch29: gimp-CVE-2026-4887.patch +Patch30: gimp-CVE-2026-58380.patch +Patch31: gimp-CVE-2026-59090.patch +Patch32: gimp-CVE-2026-18301.patch +Patch33: gimp-CVE-2026-18303.patch +Patch34: gimp-CVE-2026-18305.patch +Patch35: gimp-CVE-2026-18306.patch +Patch36: gimp-CVE-2026-66758.patch +Patch37: gimp-CVE-2026-18304.patch +Patch38: gimp-CVE-2026-18307.patch # use external help browser directly if help browser plug-in is not built Patch100: gimp-2.8.6-external-help-browser.patch @@ -343,6 +352,15 @@ EOF %patch27 -p1 -b .CVE-2026-4153 %patch28 -p1 -b .CVE-2026-4154 %patch29 -p1 -b .CVE-2026-4887 +%patch30 -p1 -b .CVE-2026-58380 +%patch31 -p1 -b .CVE-2026-59090 +%patch32 -p1 -b .CVE-2026-18301 +%patch33 -p1 -b .CVE-2026-18303 +%patch34 -p1 -b .CVE-2026-18305 +%patch35 -p1 -b .CVE-2026-18306 +%patch36 -p1 -b .CVE-2026-66758 +%patch37 -p1 -b .CVE-2026-18304 +%patch38 -p1 -b .CVE-2026-18307 %if ! %{with helpbrowser} %patch100 -p1 -b .external-help-browser %endif @@ -681,6 +699,19 @@ make check %endif %changelog +* Mon Aug 24 2026 Josef Ridky - 2:2.8.22-26.8 +- fix CVE-2026-59090 +- fix CVE-2026-18301 +- fix CVE-2026-18303 +- fix CVE-2026-18305 +- fix CVE-2026-18306 +- fix CVE-2026-66758 +- fix CVE-2026-18304 +- fix CVE-2026-18307 + +* Thu Aug 06 2026 Josef Ridky - 2:2.8.22-26.7 +- fix CVE-2026-58380 + * Tue May 12 2026 Josef Ridky - 2:2.8.22-26.6 - fix CVE-2026-4150 - fix CVE-2026-4153