74 lines
2.9 KiB
Diff
74 lines
2.9 KiB
Diff
From 0ffd587d816dbc73b091b2eba4591d61fe17af95 Mon Sep 17 00:00:00 2001
|
|
From: Gabriele Barbero <barbero.gabriele03@gmail.com>
|
|
Date: Fri, 3 Apr 2026 19:32:16 +0200
|
|
Subject: [PATCH 1/2] plug-ins: validate fcTL frame dimensions...
|
|
|
|
...against IHDR bounds in APNG loader
|
|
|
|
The pixel buffer is allocated using base image dimensions from the IHDR
|
|
chunk, but row write offsets were computed using the per-frame dimensions
|
|
from the fcTL chunk with no bounds check. A crafted APNG file with
|
|
fcTL.width > IHDR.width or fcTL.height > IHDR.height would cause
|
|
out-of-bounds writes into the heap on every row after row 0.
|
|
|
|
Reject fcTL frames whose dimensions or offsets extend beyond the base
|
|
image dimensions before proceeding with decoding.
|
|
---
|
|
plug-ins/common/file-png.c | 1 +
|
|
1 file changed, 1 insertion(+)
|
|
|
|
diff --git a/plug-ins/common/file-png.c b/plug-ins/common/file-png.c
|
|
index 0679019be3..a90f52f100 100644
|
|
--- a/plug-ins/common/file-png.c
|
|
+++ b/plug-ins/common/file-png.c
|
|
@@ -1186,6 +1186,7 @@ load_image (GFile *file,
|
|
return (GimpImage *) image;
|
|
}
|
|
|
|
+
|
|
/*
|
|
* 'offsets_dialog ()' - Asks the user about offsets when loading.
|
|
*/
|
|
|
|
From 16fe5a7cccba25385077c5ee726603dc60c55eb8 Mon Sep 17 00:00:00 2001
|
|
From: Alx Sa <cmyk.student@gmail.com>
|
|
Date: Fri, 10 Apr 2026 02:27:51 +0000
|
|
Subject: [PATCH 2/2] plug-in: Protect against invalid BPP in DDS import
|
|
|
|
Resolves #16161
|
|
DDS images have multiple locations for loading BPP values.
|
|
It is possible to craft a DDS file with conflicting BPP values
|
|
so that not enough space is allocated to read in the image.
|
|
This patch adds checks to make sure we use the largest BPP
|
|
value to allocate space to prevent this.
|
|
---
|
|
plug-ins/file-dds/ddsread.c | 11 ++++++++---
|
|
1 file changed, 8 insertions(+), 3 deletions(-)
|
|
|
|
diff --git a/plug-ins/file-dds/ddsread.c b/plug-ins/file-dds/ddsread.c
|
|
index 85a0e20b85..41285e2505 100644
|
|
--- a/plug-ins/file-dds/ddsread.c
|
|
+++ b/plug-ins/file-dds/ddsread.c
|
|
@@ -229,13 +229,18 @@ read_dds (GFile *file,
|
|
/* If format search was successful, get info needed to parse the file */
|
|
if (load_info.d3d9_format || load_info.dxgi_format)
|
|
{
|
|
+ gint d3d9_bpp = 0;
|
|
+ gint dxgi_bpp = 0;
|
|
+
|
|
load_info.read_info = get_format_read_info (load_info.d3d9_format,
|
|
load_info.dxgi_format);
|
|
|
|
- if ((! hdr.pixelfmt.bpp) && load_info.d3d9_format)
|
|
- hdr.pixelfmt.bpp = get_bpp_d3d9 (load_info.d3d9_format);
|
|
+ if (load_info.d3d9_format)
|
|
+ d3d9_bpp = get_bpp_d3d9 (load_info.d3d9_format);
|
|
else if (load_info.dxgi_format)
|
|
- hdr.pixelfmt.bpp = get_bpp_dxgi (load_info.dxgi_format);
|
|
+ dxgi_bpp = get_bpp_dxgi (load_info.dxgi_format);
|
|
+
|
|
+ hdr.pixelfmt.bpp = MAX (MAX (hdr.pixelfmt.bpp, d3d9_bpp), dxgi_bpp);
|
|
|
|
/* Unset the FourCC flag as D3D formats will be handled as uncompressed */
|
|
if ((load_info.fmt_flags & DDPF_FOURCC) && load_info.d3d9_format)
|