gimp/SOURCES/gimp-CVE-2026-42169.patch
2026-08-06 03:11:47 -04:00

74 lines
2.9 KiB
Diff

From 0ffd587d816dbc73b091b2eba4591d61fe17af95 Mon Sep 17 00:00:00 2001
From: Gabriele Barbero <barbero.gabriele03@gmail.com>
Date: Fri, 3 Apr 2026 19:32:16 +0200
Subject: [PATCH 1/2] plug-ins: validate fcTL frame dimensions...
...against IHDR bounds in APNG loader
The pixel buffer is allocated using base image dimensions from the IHDR
chunk, but row write offsets were computed using the per-frame dimensions
from the fcTL chunk with no bounds check. A crafted APNG file with
fcTL.width > IHDR.width or fcTL.height > IHDR.height would cause
out-of-bounds writes into the heap on every row after row 0.
Reject fcTL frames whose dimensions or offsets extend beyond the base
image dimensions before proceeding with decoding.
---
plug-ins/common/file-png.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/plug-ins/common/file-png.c b/plug-ins/common/file-png.c
index 0679019be3..a90f52f100 100644
--- a/plug-ins/common/file-png.c
+++ b/plug-ins/common/file-png.c
@@ -1186,6 +1186,7 @@ load_image (GFile *file,
return (GimpImage *) image;
}
+
/*
* 'offsets_dialog ()' - Asks the user about offsets when loading.
*/
From 16fe5a7cccba25385077c5ee726603dc60c55eb8 Mon Sep 17 00:00:00 2001
From: Alx Sa <cmyk.student@gmail.com>
Date: Fri, 10 Apr 2026 02:27:51 +0000
Subject: [PATCH 2/2] plug-in: Protect against invalid BPP in DDS import
Resolves #16161
DDS images have multiple locations for loading BPP values.
It is possible to craft a DDS file with conflicting BPP values
so that not enough space is allocated to read in the image.
This patch adds checks to make sure we use the largest BPP
value to allocate space to prevent this.
---
plug-ins/file-dds/ddsread.c | 11 ++++++++---
1 file changed, 8 insertions(+), 3 deletions(-)
diff --git a/plug-ins/file-dds/ddsread.c b/plug-ins/file-dds/ddsread.c
index 85a0e20b85..41285e2505 100644
--- a/plug-ins/file-dds/ddsread.c
+++ b/plug-ins/file-dds/ddsread.c
@@ -229,13 +229,18 @@ read_dds (GFile *file,
/* If format search was successful, get info needed to parse the file */
if (load_info.d3d9_format || load_info.dxgi_format)
{
+ gint d3d9_bpp = 0;
+ gint dxgi_bpp = 0;
+
load_info.read_info = get_format_read_info (load_info.d3d9_format,
load_info.dxgi_format);
- if ((! hdr.pixelfmt.bpp) && load_info.d3d9_format)
- hdr.pixelfmt.bpp = get_bpp_d3d9 (load_info.d3d9_format);
+ if (load_info.d3d9_format)
+ d3d9_bpp = get_bpp_d3d9 (load_info.d3d9_format);
else if (load_info.dxgi_format)
- hdr.pixelfmt.bpp = get_bpp_dxgi (load_info.dxgi_format);
+ dxgi_bpp = get_bpp_dxgi (load_info.dxgi_format);
+
+ hdr.pixelfmt.bpp = MAX (MAX (hdr.pixelfmt.bpp, d3d9_bpp), dxgi_bpp);
/* Unset the FourCC flag as D3D formats will be handled as uncompressed */
if ((load_info.fmt_flags & DDPF_FOURCC) && load_info.d3d9_format)