gimp/SOURCES/gimp-CVE-2026-58380.patch
2026-07-16 23:51:48 -04:00

29 lines
1.0 KiB
Diff

From e5dcc36627ed4b19d12a70dc12f0f9eb51ae56ce Mon Sep 17 00:00:00 2001
From: Alx Sa <cmyk.student@gmail.com>
Date: Sat, 11 Apr 2026 14:33:42 +0000
Subject: [PATCH] plug-ins: Boost buffer size for pnmscanner_gettoken
Resolves #16206
pnmscanner_gettoken () in file-pnm assumes that the
buffer it receives is larger than its bufsize parameter.
In almost all cases this is true, except in pnm_load_ascii ().
This patch adds the + 4 that is used everywhere else to ensure
we don't have an issue with buffer overflow.
---
plug-ins/common/file-pnm.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/plug-ins/common/file-pnm.c b/plug-ins/common/file-pnm.c
index 65619be59d..81d73c1450 100644
--- a/plug-ins/common/file-pnm.c
+++ b/plug-ins/common/file-pnm.c
@@ -958,7 +958,7 @@ pnm_load_ascii (PNMScanner *scan,
gint x, y, i, b;
gint start, end, scanlines;
gint np;
- gchar buf[BUFLEN];
+ gchar buf[BUFLEN + 4];
gboolean aborted = FALSE;
np = (info->np) ? (info->np) : 1;