diff options
| author | Markus Volk <f_l_k@t-online.de> | 2026-01-26 13:47:23 +0100 |
|---|---|---|
| committer | Khem Raj <raj.khem@gmail.com> | 2026-01-30 23:59:05 -0800 |
| commit | f8fcc9ccf529455c992e79fc13e77dfc1a8dd9d9 (patch) | |
| tree | 0cfd29e931fc8e17a6a682267451cc99849813ab | |
| parent | e854d8b7f699ea01184ff29f3ca4adccb79eace0 (diff) | |
| download | meta-openembedded-f8fcc9ccf529455c992e79fc13e77dfc1a8dd9d9.tar.gz | |
gimp: update 3.0.6 -> 3.0.8
- remove cve fixes which are included in this release
- remove the fix for bzip2. meson.build was improved so this is not
required anymore
- inherit bash-completion
This releases contains a lot of bugfixes. The below list is not
exhaustive.
Core:
- Font handling improvements:
* Font loading on start massively sped up.
* As an exception, Skia font family (apparently quite common on macOS)
is special-cased because it behaves weirdly and was not working with
current font handling.
* Various other fixes related to font handling.
* We now wait for fonts to be fully loaded before loading any file.
- Command Line Interface:
* Option -i / --no-interface is not shown anymore on `gimp-console`
binary (it can still be used — it does nothing there anyway —, which
allows to use the same sets of option with the GUI binary, and also
so that existing shell scripts don't break).
* Option --show-debug-menu is not hidden anymore for discoverability.
* The `gimp-3.0` executable can now run with --no-interface even when
no display is available (ex: virtual terminal with no window
manager/compositor, containers, etc.). This used to only work with
`gimp-console-3.0` executable.
- Windows:
* output CLI messages to the parent console like Linux and macOS.
* Ctrl+C signals are now correctly handled in the attached console.
* The attached console supports color too.
* Interpreters are run conditionally if running in console.
- macOS: default to "quartz" Input Method for emoji keyboard support.
- Wayland: wait before we get our first surface before listing input
devices to work around a Wayland limitation and GTK bug.
- Default "Search" feature in GTK3 is now disabled in the component
editor in the Channels dockable.
- Several fixes related to Quick Mask handling.
- Fixed some cases where config migration from GIMP 2 to GIMP 3 was
problematic.
- Several buggy undo cases were fixed.
- Several fixes related to pass-through group layers.
- Export will now be properly triggered even if no drawables are
selected (this is not a requirement anymore with GIMP 3 API).
- Path import and export respectively from and to SVG improved.
- Serialize colors in legacy GimpRGB format into a XCF when the XCF
version is older than GIMP 3 for backward compatibility.
Tools:
- Symmetry: fix initial stroke symmetry when using pixmap brushes.
- Move tool: fixed weird position jumps in some cases.
Graphical User Interface:
- Center buttons in overlay dialogs.
- Headerbar's (when titlebar and menubar are merged) button colors
now match our theme.
- Dialogs' header icon and view will now scale based on custom icon
size.
- Resize dialog: Canvas Size fill combo set to insensitive if layers
won't be resized.
- Navigation and Selection editor will now properly match the theme
(in particular, in dark mode, they won't show large bright area).
- Do not show outlines when hovering the absent "Fx" icon anymore,
which was confusing people into making it look like you could click
and interact with this empty area.
Plug-ins:
- Fixes on: OpenRaster export, TIFF import, Map Object, PDF export,
Gradient Flare, ANI export, Script-Fu, DDS export, Fractal Explorer,
PSP import, ICO import, XWD import, PSD import, WebP export, ICNS
import, Gimpressionist, JPEG 2000 import, Busy Dialog.
- Scale entries have been replaced by spin scale widgets in a bunch of
plug-ins.
- Fixed vulnerabilities: ZDI-CAN-28376, ZDI-CAN-28311, ZDI-CAN-28273,
ZDI-CAN-28158, ZDI-CAN-28232, ZDI-CAN-28265, ZDI-CAN-28530,
ZDI-CAN-28248, PSP issue 15732.
- Script-Fu improved to not initialize UI code unnecessarily (and
therefore make it unusable on systems without a display).
API:
- libgimp:
* Fixes where made in libgimp metadata object.
* Make GExiv2Metadata as parent of GimpMetadata visible to
Gobject-Introspection tools (bindings were missing this
information).
* Fixes made on: gimp_drawable_get_thumbnail(),
gimp_drawable_get_sub_thumbnail(), gimp_drawable_filter_new(),
gimp_proc_view_new(), gimp_procedure_set_sensitivity_mask(),
gimp_procedure_dialog_get_spin_scale().
* Remove thumbnail metadata before writing it on export, to make
sure we don't cary on metadata written by other software in
thumbnails.
- libgimpconfig:
* Improve error messaging on config deserialization.
* Fix gimp_config_serialize_value() when serializing file objects.
* New functions: gimp_config_get_xcf_version() and
gimp_config_set_xcf_version().
- libgimpcolor:
* gimp_color_is_perceptually_identical() docs clarified.
- libgimpbase:
* The host config directory is now shown in MSIX.
* The host config directory is now shown in flatpak.
- libgimpwidgets:
* Fixes made on: GimpLabelEntry, gimp_widget_free_native_handle().
- libgimpcolor:
* New function: gimp_cairo_surface_get_buffer()
* Deprecated function: gimp_cairo_surface_create_buffer() in favor
of gimp_cairo_surface_get_buffer().
The function implementation was also changed so that it does not
necessarily return a linear-memory backed buffer anymore (it
might, but developers should not have any expectation about this).
Build:
- Third-party binary plug-in support in the Snap backported from the
original third-party snap.
- Snap package for release is now created and submitted on a release
pipeline.
- Release URLs added to AppStream metadata.
- We do not build GEGL with Matting Levin for Windows builds anymore
because of crashes.
- Flatpak nightly builds will now show a pseudo-release visible with
`flatpak list`, showing proper version information.
- Windows installer now has a dark mode.
- Update changelog on MS Store (MSIX) releases.
- AppImage now ships with full MIDI support.
- Make it clearer that GExiv2 0.15.0 and over are incompatible
(because of API breakage).
- Improve build to ensure that the language list (shown in
Preferences) is localized during compilation. This also means that a
build machine should be set up for localization at build time when
optional language selection is enabled.
- We now require the generic C++14 standard, and not the GNU variant
anymore.
- MSVC support added.
- Various tweaks which used to be required to make packages work as
relocatable builds were dropped since babl and GEGL now have a
relocatable option working also on Linux.
- The `man` page of GIMP binaries was updated.
- The `gimp-console` binary is now shipped in the Flatpak.
- macOS pipeline added in our Gitlab CI.
- Make sure that harfbuzz is built with libgraphite2 shaper on macOS.
- Generate file associations for macOS automatically.
- A Bash completion file was added for `gimp` and `gimp-console`
binaries.
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
| -rw-r--r-- | meta-gnome/recipes-gimp/gimp/gimp/0001-gimp-cross-compile-fix-for-bz2.patch | 30 | ||||
| -rw-r--r-- | meta-gnome/recipes-gimp/gimp/gimp/CVE-2025-14422.patch | 66 | ||||
| -rw-r--r-- | meta-gnome/recipes-gimp/gimp/gimp/CVE-2025-14423.patch | 106 | ||||
| -rw-r--r-- | meta-gnome/recipes-gimp/gimp/gimp/CVE-2025-14424.patch | 34 | ||||
| -rw-r--r-- | meta-gnome/recipes-gimp/gimp/gimp/CVE-2025-14425.patch | 79 | ||||
| -rw-r--r-- | meta-gnome/recipes-gimp/gimp/gimp_3.0.8.bb (renamed from meta-gnome/recipes-gimp/gimp/gimp_3.0.6.bb) | 9 |
6 files changed, 2 insertions, 322 deletions
diff --git a/meta-gnome/recipes-gimp/gimp/gimp/0001-gimp-cross-compile-fix-for-bz2.patch b/meta-gnome/recipes-gimp/gimp/gimp/0001-gimp-cross-compile-fix-for-bz2.patch deleted file mode 100644 index 380e425f25..0000000000 --- a/meta-gnome/recipes-gimp/gimp/gimp/0001-gimp-cross-compile-fix-for-bz2.patch +++ /dev/null | |||
| @@ -1,30 +0,0 @@ | |||
| 1 | From a7e40e19d17404cf5ec4135fc1becd5a90f5e1e1 Mon Sep 17 00:00:00 2001 | ||
| 2 | From: Markus Volk <f_l_k@t-online.de> | ||
| 3 | Date: Wed, 25 Dec 2024 07:27:04 +0100 | ||
| 4 | Subject: [PATCH] gimp: cross-compile fix for bz2 | ||
| 5 | |||
| 6 | autotools bzip2 build does not create pkgconfig files so looking for the dependency fails. | ||
| 7 | |||
| 8 | Signed-off-by: Markus Volk <f_l_k@t-online.de> | ||
| 9 | |||
| 10 | Upstream-Status: Inappropriate [can probably be removed once bzip2 is built with meson or cmake] | ||
| 11 | --- | ||
| 12 | meson.build | 2 +- | ||
| 13 | 1 file changed, 1 insertion(+), 1 deletion(-) | ||
| 14 | |||
| 15 | diff --git a/meson.build b/meson.build | ||
| 16 | index 4e48f8c64c..d5dce47015 100644 | ||
| 17 | --- a/meson.build | ||
| 18 | +++ b/meson.build | ||
| 19 | @@ -777,7 +777,7 @@ zlib = dependency('zlib') | ||
| 20 | zlib = dependency('zlib') | ||
| 21 | |||
| 22 | # Compiler-provided headers can't be found in crossroads environment | ||
| 23 | -if not meson.is_cross_build() | ||
| 24 | +if true | ||
| 25 | bz2 = cc.find_library('bz2') | ||
| 26 | else | ||
| 27 | bz2 = dependency('bzip2') | ||
| 28 | -- | ||
| 29 | 2.47.1 | ||
| 30 | |||
diff --git a/meta-gnome/recipes-gimp/gimp/gimp/CVE-2025-14422.patch b/meta-gnome/recipes-gimp/gimp/gimp/CVE-2025-14422.patch deleted file mode 100644 index 420e013916..0000000000 --- a/meta-gnome/recipes-gimp/gimp/gimp/CVE-2025-14422.patch +++ /dev/null | |||
| @@ -1,66 +0,0 @@ | |||
| 1 | From 0a941cab81396d65a8ab547847f8c542039e214f Mon Sep 17 00:00:00 2001 | ||
| 2 | From: Gyorgy Sarvari <skandigraun@gmail.com> | ||
| 3 | Date: Sun, 23 Nov 2025 16:43:51 +0000 | ||
| 4 | Subject: [PATCH] plug-ins: Fix ZDI-CAN-28273 | ||
| 5 | |||
| 6 | From: Alx Sa <cmyk.student@gmail.com> | ||
| 7 | |||
| 8 | Resolves #15286 | ||
| 9 | Adds a check to the memory allocation | ||
| 10 | in pnm_load_raw () with g_size_checked_mul () | ||
| 11 | to see if the size would go out of bounds. | ||
| 12 | If so, we don't try to allocate and load the | ||
| 13 | image. | ||
| 14 | |||
| 15 | CVE: CVE-2025-14422 | ||
| 16 | Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/gimp/-/commit/4ff2d773d58064e6130495de498e440f4a6d5edb] | ||
| 17 | Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> | ||
| 18 | --- | ||
| 19 | plug-ins/common/file-pnm.c | 13 +++++++++++-- | ||
| 20 | 1 file changed, 11 insertions(+), 2 deletions(-) | ||
| 21 | |||
| 22 | diff --git a/plug-ins/common/file-pnm.c b/plug-ins/common/file-pnm.c | ||
| 23 | index 32a33a4..9d349e9 100644 | ||
| 24 | --- a/plug-ins/common/file-pnm.c | ||
| 25 | +++ b/plug-ins/common/file-pnm.c | ||
| 26 | @@ -674,7 +674,7 @@ load_image (GFile *file, | ||
| 27 | GError **error) | ||
| 28 | { | ||
| 29 | GInputStream *input; | ||
| 30 | - GeglBuffer *buffer; | ||
| 31 | + GeglBuffer *buffer = NULL; | ||
| 32 | GimpImage * volatile image = NULL; | ||
| 33 | GimpLayer *layer; | ||
| 34 | char buf[BUFLEN + 4]; /* buffer for random things like scanning */ | ||
| 35 | @@ -708,6 +708,9 @@ load_image (GFile *file, | ||
| 36 | g_object_unref (input); | ||
| 37 | g_free (pnminfo); | ||
| 38 | |||
| 39 | + if (buffer) | ||
| 40 | + g_object_unref (buffer); | ||
| 41 | + | ||
| 42 | if (image) | ||
| 43 | gimp_image_delete (image); | ||
| 44 | |||
| 45 | @@ -1060,6 +1063,7 @@ pnm_load_raw (PNMScanner *scan, | ||
| 46 | const Babl *format = NULL; | ||
| 47 | gint bpc; | ||
| 48 | guchar *data, *d; | ||
| 49 | + gsize data_size; | ||
| 50 | gushort *s; | ||
| 51 | gint x, y, i; | ||
| 52 | gint start, end, scanlines; | ||
| 53 | @@ -1070,7 +1074,12 @@ pnm_load_raw (PNMScanner *scan, | ||
| 54 | bpc = 1; | ||
| 55 | |||
| 56 | /* No overflow as long as gimp_tile_height() < 1365 = 2^(31 - 18) / 6 */ | ||
| 57 | - data = g_new (guchar, gimp_tile_height () * info->xres * info->np * bpc); | ||
| 58 | + if (! g_size_checked_mul (&data_size, gimp_tile_height (), info->xres) || | ||
| 59 | + ! g_size_checked_mul (&data_size, data_size, info->np) || | ||
| 60 | + ! g_size_checked_mul (&data_size, data_size, bpc)) | ||
| 61 | + CHECK_FOR_ERROR (FALSE, info->jmpbuf, _("Unsupported maximum value.")); | ||
| 62 | + | ||
| 63 | + data = g_new (guchar, data_size); | ||
| 64 | |||
| 65 | input = pnmscanner_input (scan); | ||
| 66 | |||
diff --git a/meta-gnome/recipes-gimp/gimp/gimp/CVE-2025-14423.patch b/meta-gnome/recipes-gimp/gimp/gimp/CVE-2025-14423.patch deleted file mode 100644 index 50a0adfe89..0000000000 --- a/meta-gnome/recipes-gimp/gimp/gimp/CVE-2025-14423.patch +++ /dev/null | |||
| @@ -1,106 +0,0 @@ | |||
| 1 | From a83e8c4ad8ffbce40aa9f9a0f49880e802ef7da1 Mon Sep 17 00:00:00 2001 | ||
| 2 | From: Gyorgy Sarvari <skandigraun@gmail.com> | ||
| 3 | Date: Sun, 23 Nov 2025 04:22:49 +0000 | ||
| 4 | Subject: [PATCH] plug-ins: Fix ZDI-CAN-28311 | ||
| 5 | |||
| 6 | From: Alx Sa <cmyk.student@gmail.com> | ||
| 7 | |||
| 8 | Resolves #15292 | ||
| 9 | The IFF specification states that EHB format images | ||
| 10 | have exactly 32 colors in their palette. However, it | ||
| 11 | is possible for images in the wild to place an incorrect | ||
| 12 | palette size. This patch checks for this, and either limits | ||
| 13 | the palette size or breaks accordingly. | ||
| 14 | |||
| 15 | CVE: CVE-2025-14423 | ||
| 16 | Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/gimp/-/commit/481cdbbb97746be1145ec3a633c567a68633c521] | ||
| 17 | Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> | ||
| 18 | --- | ||
| 19 | plug-ins/common/file-iff.c | 32 ++++++++++++++++++++++---------- | ||
| 20 | 1 file changed, 22 insertions(+), 10 deletions(-) | ||
| 21 | |||
| 22 | diff --git a/plug-ins/common/file-iff.c b/plug-ins/common/file-iff.c | ||
| 23 | index d144a96..f087947 100644 | ||
| 24 | --- a/plug-ins/common/file-iff.c | ||
| 25 | +++ b/plug-ins/common/file-iff.c | ||
| 26 | @@ -337,7 +337,7 @@ load_image (GFile *file, | ||
| 27 | width = bitMapHeader->w; | ||
| 28 | height = bitMapHeader->h; | ||
| 29 | nPlanes = bitMapHeader->nPlanes; | ||
| 30 | - row_length = (width + 15) / 16; | ||
| 31 | + row_length = ((width + 15) / 16) * 2; | ||
| 32 | pixel_size = nPlanes / 8; | ||
| 33 | aspect_x = bitMapHeader->xAspect; | ||
| 34 | aspect_y = bitMapHeader->yAspect; | ||
| 35 | @@ -375,6 +375,18 @@ load_image (GFile *file, | ||
| 36 | { | ||
| 37 | /* EHB mode adds 32 more colors. Each are half the RGB values | ||
| 38 | * of the first 32 colors */ | ||
| 39 | + if (palette_size < 32) | ||
| 40 | + { | ||
| 41 | + g_set_error (error, G_FILE_ERROR, | ||
| 42 | + g_file_error_from_errno (errno), | ||
| 43 | + _("Invalid ILBM colormap size")); | ||
| 44 | + return NULL; | ||
| 45 | + } | ||
| 46 | + else if (palette_size > 32) | ||
| 47 | + { | ||
| 48 | + palette_size = 32; | ||
| 49 | + } | ||
| 50 | + | ||
| 51 | for (gint j = 0; j < palette_size * 2; j++) | ||
| 52 | { | ||
| 53 | gint offset_index = j + 32; | ||
| 54 | @@ -386,7 +398,7 @@ load_image (GFile *file, | ||
| 55 | gimp_cmap[offset_index * 3 + 2] = | ||
| 56 | colorMap->colorRegister[j].blue / 2; | ||
| 57 | } | ||
| 58 | - /* EHB mode always has 64 colors */ | ||
| 59 | + /* EHB mode always has 64 colors in total */ | ||
| 60 | palette_size = 64; | ||
| 61 | } | ||
| 62 | } | ||
| 63 | @@ -447,7 +459,7 @@ load_image (GFile *file, | ||
| 64 | { | ||
| 65 | guchar *pixel_row; | ||
| 66 | |||
| 67 | - pixel_row = g_malloc (width * pixel_size * sizeof (guchar)); | ||
| 68 | + pixel_row = g_malloc0 (width * pixel_size); | ||
| 69 | |||
| 70 | /* PBM uses one byte per pixel index */ | ||
| 71 | if (ILBM_imageIsPBM (true_image)) | ||
| 72 | @@ -459,7 +471,7 @@ load_image (GFile *file, | ||
| 73 | else | ||
| 74 | deleave_rgb_row (bitplanes, pixel_row, width, nPlanes, pixel_size); | ||
| 75 | |||
| 76 | - bitplanes += (row_length * 2 * nPlanes); | ||
| 77 | + bitplanes += (row_length * nPlanes); | ||
| 78 | |||
| 79 | gegl_buffer_set (buffer, GEGL_RECTANGLE (0, y_height, width, 1), 0, | ||
| 80 | NULL, pixel_row, GEGL_AUTO_ROWSTRIDE); | ||
| 81 | @@ -528,7 +540,7 @@ deleave_ham_row (const guchar *gimp_cmap, | ||
| 82 | /* Deleave rows */ | ||
| 83 | for (gint i = 0; i < row_length; i++) | ||
| 84 | { | ||
| 85 | - for (gint j = 0; j < 8; j++) | ||
| 86 | + for (gint j = 0; j < nPlanes; j++) | ||
| 87 | { | ||
| 88 | guint8 bitmask = (1 << (8 - j)) - (1 << (7 - j)); | ||
| 89 | guint8 control = 0; | ||
| 90 | @@ -590,11 +602,11 @@ deleave_ham_row (const guchar *gimp_cmap, | ||
| 91 | } | ||
| 92 | |||
| 93 | static void | ||
| 94 | -deleave_rgb_row (IFF_UByte *bitplanes, | ||
| 95 | - guchar *pixel_row, | ||
| 96 | - gint width, | ||
| 97 | - gint nPlanes, | ||
| 98 | - gint pixel_size) | ||
| 99 | +deleave_rgb_row (IFF_UByte *bitplanes, | ||
| 100 | + guchar *pixel_row, | ||
| 101 | + gint width, | ||
| 102 | + gint nPlanes, | ||
| 103 | + gint pixel_size) | ||
| 104 | { | ||
| 105 | gint row_length = ((width + 15) / 16) * 2; | ||
| 106 | gint current_pixel = 0; | ||
diff --git a/meta-gnome/recipes-gimp/gimp/gimp/CVE-2025-14424.patch b/meta-gnome/recipes-gimp/gimp/gimp/CVE-2025-14424.patch deleted file mode 100644 index e7821d3109..0000000000 --- a/meta-gnome/recipes-gimp/gimp/gimp/CVE-2025-14424.patch +++ /dev/null | |||
| @@ -1,34 +0,0 @@ | |||
| 1 | From d30875b606085316b1cb7ac1da0d26e5bac0cf2c Mon Sep 17 00:00:00 2001 | ||
| 2 | From: Gyorgy Sarvari <skandigraun@gmail.com> | ||
| 3 | Date: Thu, 13 Nov 2025 18:26:51 -0500 | ||
| 4 | Subject: [PATCH] app: fix #15288 crash when loading malformed xcf | ||
| 5 | |||
| 6 | From: Jacob Boerema <jgboerema@gmail.com> | ||
| 7 | |||
| 8 | ZDI-CAN-28376 vulnerability | ||
| 9 | |||
| 10 | Add extra tests to not crash on a NULL g_class. | ||
| 11 | |||
| 12 | CVE: CVE-2025-14424 | ||
| 13 | Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/gimp/-/commit/5cc55d078b7fba995cef77d195fac325ee288ddd] | ||
| 14 | Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> | ||
| 15 | --- | ||
| 16 | app/core/gimpitemlist.c | 5 ++++- | ||
| 17 | 1 file changed, 4 insertions(+), 1 deletion(-) | ||
| 18 | |||
| 19 | diff --git a/app/core/gimpitemlist.c b/app/core/gimpitemlist.c | ||
| 20 | index 6473938..a431519 100644 | ||
| 21 | --- a/app/core/gimpitemlist.c | ||
| 22 | +++ b/app/core/gimpitemlist.c | ||
| 23 | @@ -345,7 +345,10 @@ gimp_item_list_named_new (GimpImage *image, | ||
| 24 | g_return_val_if_fail (GIMP_IS_IMAGE (image), NULL); | ||
| 25 | |||
| 26 | for (iter = items; iter; iter = iter->next) | ||
| 27 | - g_return_val_if_fail (g_type_is_a (G_OBJECT_TYPE (iter->data), item_type), NULL); | ||
| 28 | + { | ||
| 29 | + g_return_val_if_fail (iter->data && ((GTypeInstance*) (iter->data))->g_class, NULL); | ||
| 30 | + g_return_val_if_fail (g_type_is_a (G_OBJECT_TYPE (iter->data), item_type), NULL); | ||
| 31 | + } | ||
| 32 | |||
| 33 | if (! items) | ||
| 34 | { | ||
diff --git a/meta-gnome/recipes-gimp/gimp/gimp/CVE-2025-14425.patch b/meta-gnome/recipes-gimp/gimp/gimp/CVE-2025-14425.patch deleted file mode 100644 index 44e9587570..0000000000 --- a/meta-gnome/recipes-gimp/gimp/gimp/CVE-2025-14425.patch +++ /dev/null | |||
| @@ -1,79 +0,0 @@ | |||
| 1 | From 042e27792026460badbe49664c02fe181e95cb2b Mon Sep 17 00:00:00 2001 | ||
| 2 | From: Gyorgy Sarvari <skandigraun@gmail.com> | ||
| 3 | Date: Wed, 12 Nov 2025 13:25:44 +0000 | ||
| 4 | Subject: [PATCH] plug-ins: Mitigate ZDI-CAN-28248 for JP2 images | ||
| 5 | |||
| 6 | From: Alx Sa <cmyk.student@gmail.com> | ||
| 7 | |||
| 8 | Resolves #15285 | ||
| 9 | Per the report, it's possible to exceed the size of the pixel buffer | ||
| 10 | with a high precision_scaled value, as we size it to the width * bpp. | ||
| 11 | This patch includes precision_scaled in the allocation calculation. | ||
| 12 | It also adds a g_size_checked_mul () check to ensure there's no | ||
| 13 | overflow, and moves the pixel and buffer memory freeing to occur | ||
| 14 | in the out section so that it always runs even on failure. | ||
| 15 | |||
| 16 | CVE: CVE-2025-14425 | ||
| 17 | Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/gimp/-/commit/cd1c88a0364ad1444c06536731972a99bd8643fd] | ||
| 18 | Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> | ||
| 19 | --- | ||
| 20 | plug-ins/common/file-jp2-load.c | 23 ++++++++++++++++------- | ||
| 21 | 1 file changed, 16 insertions(+), 7 deletions(-) | ||
| 22 | |||
| 23 | diff --git a/plug-ins/common/file-jp2-load.c b/plug-ins/common/file-jp2-load.c | ||
| 24 | index 064b616..604313a 100644 | ||
| 25 | --- a/plug-ins/common/file-jp2-load.c | ||
| 26 | +++ b/plug-ins/common/file-jp2-load.c | ||
| 27 | @@ -1045,14 +1045,15 @@ load_image (GimpProcedure *procedure, | ||
| 28 | GimpColorProfile *profile = NULL; | ||
| 29 | GimpImage *gimp_image = NULL; | ||
| 30 | GimpLayer *layer; | ||
| 31 | + GeglBuffer *buffer = NULL; | ||
| 32 | + guchar *pixels = NULL; | ||
| 33 | + gsize pixels_size; | ||
| 34 | GimpImageType image_type; | ||
| 35 | GimpImageBaseType base_type; | ||
| 36 | gint width; | ||
| 37 | gint height; | ||
| 38 | gint num_components; | ||
| 39 | - GeglBuffer *buffer; | ||
| 40 | gint i, j, k, it; | ||
| 41 | - guchar *pixels; | ||
| 42 | const Babl *file_format; | ||
| 43 | gint bpp; | ||
| 44 | GimpPrecision image_precision; | ||
| 45 | @@ -1318,7 +1319,15 @@ load_image (GimpProcedure *procedure, | ||
| 46 | bpp = babl_format_get_bytes_per_pixel (file_format); | ||
| 47 | |||
| 48 | buffer = gimp_drawable_get_buffer (GIMP_DRAWABLE (layer)); | ||
| 49 | - pixels = g_new0 (guchar, width * bpp); | ||
| 50 | + | ||
| 51 | + if (! g_size_checked_mul (&pixels_size, width, (bpp * (precision_scaled / 8)))) | ||
| 52 | + { | ||
| 53 | + g_set_error (error, GIMP_PLUG_IN_ERROR, 0, | ||
| 54 | + _("Defined row size is too large in JP2 image '%s'."), | ||
| 55 | + gimp_file_get_utf8_name (file)); | ||
| 56 | + goto out; | ||
| 57 | + } | ||
| 58 | + pixels = g_new0 (guchar, pixels_size); | ||
| 59 | |||
| 60 | for (i = 0; i < height; i++) | ||
| 61 | { | ||
| 62 | @@ -1344,13 +1353,13 @@ load_image (GimpProcedure *procedure, | ||
| 63 | gegl_buffer_set (buffer, GEGL_RECTANGLE (0, i, width, 1), 0, | ||
| 64 | file_format, pixels, GEGL_AUTO_ROWSTRIDE); | ||
| 65 | } | ||
| 66 | - | ||
| 67 | - g_free (pixels); | ||
| 68 | - | ||
| 69 | - g_object_unref (buffer); | ||
| 70 | gimp_progress_update (1.0); | ||
| 71 | |||
| 72 | out: | ||
| 73 | + if (pixels) | ||
| 74 | + g_free (pixels); | ||
| 75 | + if (buffer) | ||
| 76 | + g_object_unref (buffer); | ||
| 77 | if (profile) | ||
| 78 | g_object_unref (profile); | ||
| 79 | if (image) | ||
diff --git a/meta-gnome/recipes-gimp/gimp/gimp_3.0.6.bb b/meta-gnome/recipes-gimp/gimp/gimp_3.0.8.bb index fa192555bc..a5e892c508 100644 --- a/meta-gnome/recipes-gimp/gimp/gimp_3.0.6.bb +++ b/meta-gnome/recipes-gimp/gimp/gimp_3.0.8.bb | |||
| @@ -46,7 +46,7 @@ DEPENDS:append:libc-musl = " libexecinfo" | |||
| 46 | 46 | ||
| 47 | LDFLAGS:append:libc-musl = " -lexecinfo" | 47 | LDFLAGS:append:libc-musl = " -lexecinfo" |
| 48 | 48 | ||
| 49 | inherit meson gtk-icon-cache mime-xdg pkgconfig gettext gobject-introspection vala | 49 | inherit meson gtk-icon-cache mime-xdg pkgconfig gettext gobject-introspection vala bash-completion |
| 50 | 50 | ||
| 51 | GIR_MESON_OPTION = 'can-crosscompile-gir' | 51 | GIR_MESON_OPTION = 'can-crosscompile-gir' |
| 52 | VALA_MESON_OPTION = "vala" | 52 | VALA_MESON_OPTION = "vala" |
| @@ -57,16 +57,11 @@ GIDOCGEN_MESON_ENABLE_FLAG = "enabled" | |||
| 57 | GIDOCGEN_MESON_DISABLE_FLAG = "disabled" | 57 | GIDOCGEN_MESON_DISABLE_FLAG = "disabled" |
| 58 | 58 | ||
| 59 | SRC_URI = "https://download.gimp.org/gimp/v3.0/${BP}.tar.xz \ | 59 | SRC_URI = "https://download.gimp.org/gimp/v3.0/${BP}.tar.xz \ |
| 60 | file://0001-gimp-cross-compile-fix-for-bz2.patch \ | ||
| 61 | file://0002-meson.build-reproducibility-fix.patch \ | 60 | file://0002-meson.build-reproducibility-fix.patch \ |
| 62 | file://0001-meson.build-dont-check-for-lgi.patch \ | 61 | file://0001-meson.build-dont-check-for-lgi.patch \ |
| 63 | file://0001-meson.build-require-iso-codes-native.patch \ | 62 | file://0001-meson.build-require-iso-codes-native.patch \ |
| 64 | file://CVE-2025-14422.patch \ | ||
| 65 | file://CVE-2025-14423.patch \ | ||
| 66 | file://CVE-2025-14424.patch \ | ||
| 67 | file://CVE-2025-14425.patch \ | ||
| 68 | " | 63 | " |
| 69 | SRC_URI[sha256sum] = "246c225383c72ef9f0dc7703b7d707084bbf177bd2900e94ce466a62862e296b" | 64 | SRC_URI[sha256sum] = "feb498acc01b26827cff1ff95aa8fb82cdd6a60d7abf773cfcd19abeafca3386" |
| 70 | 65 | ||
| 71 | PACKAGECONFIG[aa] = "-Daa=enabled,-Daa=disabled,aalib" | 66 | PACKAGECONFIG[aa] = "-Daa=enabled,-Daa=disabled,aalib" |
| 72 | PACKAGECONFIG[alsa] = "-Dalsa=enabled,-Dalsa=disabled,alsa-lib" | 67 | PACKAGECONFIG[alsa] = "-Dalsa=enabled,-Dalsa=disabled,alsa-lib" |
