gimp/SOURCES/gimp-CVE-2026-66758.patch
2026-08-06 03:11:47 -04:00

130 lines
5.2 KiB
Diff

From 9061982fec1fc8732253fce8463150acd4a312cc Mon Sep 17 00:00:00 2001
From: Alx Sa <cmyk.student@gmail.com>
Date: Sun, 28 Jun 2026 12:58:47 +0000
Subject: [PATCH 1/2] plug-ins: Mitigate overflow in FITS import
When allocating memory for importing FITS, it was
possible for the operation to overflow the largest
datatype size, guint32. This patch adds a cast to
gsize for this operation, to reduce the risk of exceeding
the space limit before attempting to allocate.
---
plug-ins/file-fits/fits.c | 14 ++++++++++++--
1 file changed, 12 insertions(+), 2 deletions(-)
diff --git a/plug-ins/file-fits/fits.c b/plug-ins/file-fits/fits.c
index b4a8dbb433..2cd40f1c3f 100644
--- a/plug-ins/file-fits/fits.c
+++ b/plug-ins/file-fits/fits.c
@@ -477,9 +477,19 @@ load_image (GFile *file,
/* If RGB FITS image, we need to read in the whole image so we can convert
* the planes format to RGB */
if (hdu.naxis == 2)
- pixels = (gdouble *) malloc (width * sizeof (gdouble) * channels);
+ pixels = (gdouble *) g_try_malloc ((gsize) width * sizeof (gdouble) *
+ channels);
else
- pixels = (gdouble *) malloc (width * height * sizeof (gdouble) * channels);
+ pixels = (gdouble *) g_try_malloc ((gsize) width * height *
+ sizeof (gdouble) * channels);
+
+ if (pixels == NULL)
+ {
+ g_set_error (error, G_FILE_ERROR, 0,
+ "Memory could not be allocated.");
+ fits_close_file (ifp, &status);
+ return NULL;
+ }
if (! image)
{
From a432acf939384e85c23de67509c9b3f4d4fe43ca Mon Sep 17 00:00:00 2001
From: Alx Sa <cmyk.student@gmail.com>
Date: Wed, 8 Jul 2026 19:29:17 +0000
Subject: [PATCH 2/2] plug-ins: Add more memory checks for FITS imports
As suggested by Michael Catanzaro and Tristan Madani,
this patch adds calls to g_size_checked_mul () to determine
if the requested size for FITS import memory allocation would
overflow in the two places we allocate.
---
plug-ins/file-fits/fits.c | 40 ++++++++++++++++++++++++---------------
1 file changed, 25 insertions(+), 15 deletions(-)
diff --git a/plug-ins/file-fits/fits.c b/plug-ins/file-fits/fits.c
index 2cd40f1c3f..273156c5f8 100644
--- a/plug-ins/file-fits/fits.c
+++ b/plug-ins/file-fits/fits.c
@@ -351,6 +351,7 @@ load_image (GFile *file,
const Babl *type = NULL;
const Babl *format = NULL;
gdouble *pixels;
+ gsize allocate;
gdouble datamin = 1.0E30f;
gdouble datamax = -1.0E30f;
gint channels = 1;
@@ -474,21 +475,18 @@ load_image (GFile *file,
NULL);
}
- /* If RGB FITS image, we need to read in the whole image so we can convert
- * the planes format to RGB */
- if (hdu.naxis == 2)
- pixels = (gdouble *) g_try_malloc ((gsize) width * sizeof (gdouble) *
- channels);
- else
- pixels = (gdouble *) g_try_malloc ((gsize) width * height *
- sizeof (gdouble) * channels);
-
- if (pixels == NULL)
+ /* If RGB FITS image, we need to read in the whole image so we can
+ * convert the planes format to RGB */
+ if (! g_size_checked_mul (&allocate, width, sizeof (gdouble)) ||
+ ! g_size_checked_mul (&allocate, allocate, channels) ||
+ (hdu.naxis > 2 && ! g_size_checked_mul (&allocate, allocate, height)) ||
+ ! (pixels = (gdouble *) g_try_malloc (allocate)))
{
- g_set_error (error, G_FILE_ERROR, 0,
- "Memory could not be allocated.");
+ g_set_error (error, GIMP_PLUG_IN_ERROR, 0,
+ _("There was not enough memory to complete the "
+ "operation."));
fits_close_file (ifp, &status);
- return NULL;
+ return image;
}
if (! image)
@@ -559,8 +557,20 @@ load_image (GFile *file,
if (! status)
{
gdouble *temp;
+ gsize allocate;
- temp = (gdouble *) malloc (width * height * sizeof (gdouble) * channels);
+ if (! g_size_checked_mul (&allocate, width, sizeof (gdouble)) ||
+ ! g_size_checked_mul (&allocate, allocate, channels) ||
+ ! g_size_checked_mul (&allocate, allocate, height) ||
+ ! (temp = (gdouble *) g_try_malloc (allocate)))
+ {
+ g_set_error (error, GIMP_PLUG_IN_ERROR, 0,
+ _("There was not enough memory to complete the "
+ "operation."));
+ fits_close_file (ifp, &status);
+ g_object_unref (buffer);
+ return image;
+ }
if (datamin < datamax)
{
@@ -936,7 +946,7 @@ export_fits (GFile *file,
}
src_offset += width * channelnum;
- offset += width;
+ offset += width;
}
if (export_type == TFLOAT)