Michael Vetter
8a8cfef6d6
+ gimp-CVE-2025-14422.patch (bsc#1255293 CVE-2025-14422) + gimp-CVE-2025-14423.patch (bsc#1255294 CVE-2025-14423) + gimp-CVE-2025-14424.patch (bsc#1255295 CVE-2025-14424) + gimp-CVE-2025-14425.patch (bsc#1255296 CVE-2025-14425) OBS-URL: https://build.opensuse.org/package/show/graphics/gimp?expand=0&rev=100
64 lines
2.0 KiB
Diff
64 lines
2.0 KiB
Diff
From 4ff2d773d58064e6130495de498e440f4a6d5edb Mon Sep 17 00:00:00 2001
|
|
From: Alx Sa <cmyk.student@gmail.com>
|
|
Date: Sun, 23 Nov 2025 16:43:51 +0000
|
|
Subject: [PATCH] plug-ins: Fix ZDI-CAN-28273
|
|
|
|
Resolves #15286
|
|
Adds a check to the memory allocation
|
|
in pnm_load_raw () with g_size_checked_mul ()
|
|
to see if the size would go out of bounds.
|
|
If so, we don't try to allocate and load the
|
|
image.
|
|
---
|
|
plug-ins/common/file-pnm.c | 13 +++++++++++--
|
|
1 file changed, 11 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/plug-ins/common/file-pnm.c b/plug-ins/common/file-pnm.c
|
|
index 32a33a4f35..9d349e967e 100644
|
|
--- a/plug-ins/common/file-pnm.c
|
|
+++ b/plug-ins/common/file-pnm.c
|
|
@@ -674,7 +674,7 @@ load_image (GFile *file,
|
|
GError **error)
|
|
{
|
|
GInputStream *input;
|
|
- GeglBuffer *buffer;
|
|
+ GeglBuffer *buffer = NULL;
|
|
GimpImage * volatile image = NULL;
|
|
GimpLayer *layer;
|
|
char buf[BUFLEN + 4]; /* buffer for random things like scanning */
|
|
@@ -708,6 +708,9 @@ load_image (GFile *file,
|
|
g_object_unref (input);
|
|
g_free (pnminfo);
|
|
|
|
+ if (buffer)
|
|
+ g_object_unref (buffer);
|
|
+
|
|
if (image)
|
|
gimp_image_delete (image);
|
|
|
|
@@ -1060,6 +1063,7 @@ pnm_load_raw (PNMScanner *scan,
|
|
const Babl *format = NULL;
|
|
gint bpc;
|
|
guchar *data, *d;
|
|
+ gsize data_size;
|
|
gushort *s;
|
|
gint x, y, i;
|
|
gint start, end, scanlines;
|
|
@@ -1070,7 +1074,12 @@ pnm_load_raw (PNMScanner *scan,
|
|
bpc = 1;
|
|
|
|
/* No overflow as long as gimp_tile_height() < 1365 = 2^(31 - 18) / 6 */
|
|
- data = g_new (guchar, gimp_tile_height () * info->xres * info->np * bpc);
|
|
+ if (! g_size_checked_mul (&data_size, gimp_tile_height (), info->xres) ||
|
|
+ ! g_size_checked_mul (&data_size, data_size, info->np) ||
|
|
+ ! g_size_checked_mul (&data_size, data_size, bpc))
|
|
+ CHECK_FOR_ERROR (FALSE, info->jmpbuf, _("Unsupported maximum value."));
|
|
+
|
|
+ data = g_new (guchar, data_size);
|
|
|
|
input = pnmscanner_input (scan);
|
|
|
|
--
|
|
2.52.0
|
|
|