summaryrefslogtreecommitdiffstats
path: root/meta-gnome
diff options
context:
space:
mode:
Diffstat (limited to 'meta-gnome')
-rw-r--r--meta-gnome/recipes-gimp/gimp/gimp/0001-gimp-cross-compile-fix-for-bz2.patch30
-rw-r--r--meta-gnome/recipes-gimp/gimp/gimp/CVE-2025-14422.patch66
-rw-r--r--meta-gnome/recipes-gimp/gimp/gimp/CVE-2025-14423.patch106
-rw-r--r--meta-gnome/recipes-gimp/gimp/gimp/CVE-2025-14424.patch34
-rw-r--r--meta-gnome/recipes-gimp/gimp/gimp/CVE-2025-14425.patch79
-rw-r--r--meta-gnome/recipes-gimp/gimp/gimp_3.0.8.bb (renamed from meta-gnome/recipes-gimp/gimp/gimp_3.0.6.bb)9
6 files changed, 2 insertions, 322 deletions
diff --git a/meta-gnome/recipes-gimp/gimp/gimp/0001-gimp-cross-compile-fix-for-bz2.patch b/meta-gnome/recipes-gimp/gimp/gimp/0001-gimp-cross-compile-fix-for-bz2.patch
deleted file mode 100644
index 380e425f25..0000000000
--- a/meta-gnome/recipes-gimp/gimp/gimp/0001-gimp-cross-compile-fix-for-bz2.patch
+++ /dev/null
@@ -1,30 +0,0 @@
1From a7e40e19d17404cf5ec4135fc1becd5a90f5e1e1 Mon Sep 17 00:00:00 2001
2From: Markus Volk <f_l_k@t-online.de>
3Date: Wed, 25 Dec 2024 07:27:04 +0100
4Subject: [PATCH] gimp: cross-compile fix for bz2
5
6autotools bzip2 build does not create pkgconfig files so looking for the dependency fails.
7
8Signed-off-by: Markus Volk <f_l_k@t-online.de>
9
10Upstream-Status: Inappropriate [can probably be removed once bzip2 is built with meson or cmake]
11---
12 meson.build | 2 +-
13 1 file changed, 1 insertion(+), 1 deletion(-)
14
15diff --git a/meson.build b/meson.build
16index 4e48f8c64c..d5dce47015 100644
17--- a/meson.build
18+++ b/meson.build
19@@ -777,7 +777,7 @@ zlib = dependency('zlib')
20 zlib = dependency('zlib')
21
22 # Compiler-provided headers can't be found in crossroads environment
23-if not meson.is_cross_build()
24+if true
25 bz2 = cc.find_library('bz2')
26 else
27 bz2 = dependency('bzip2')
28--
292.47.1
30
diff --git a/meta-gnome/recipes-gimp/gimp/gimp/CVE-2025-14422.patch b/meta-gnome/recipes-gimp/gimp/gimp/CVE-2025-14422.patch
deleted file mode 100644
index 420e013916..0000000000
--- a/meta-gnome/recipes-gimp/gimp/gimp/CVE-2025-14422.patch
+++ /dev/null
@@ -1,66 +0,0 @@
1From 0a941cab81396d65a8ab547847f8c542039e214f Mon Sep 17 00:00:00 2001
2From: Gyorgy Sarvari <skandigraun@gmail.com>
3Date: Sun, 23 Nov 2025 16:43:51 +0000
4Subject: [PATCH] plug-ins: Fix ZDI-CAN-28273
5
6From: Alx Sa <cmyk.student@gmail.com>
7
8Resolves #15286
9Adds a check to the memory allocation
10in pnm_load_raw () with g_size_checked_mul ()
11to see if the size would go out of bounds.
12If so, we don't try to allocate and load the
13image.
14
15CVE: CVE-2025-14422
16Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/gimp/-/commit/4ff2d773d58064e6130495de498e440f4a6d5edb]
17Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
18---
19 plug-ins/common/file-pnm.c | 13 +++++++++++--
20 1 file changed, 11 insertions(+), 2 deletions(-)
21
22diff --git a/plug-ins/common/file-pnm.c b/plug-ins/common/file-pnm.c
23index 32a33a4..9d349e9 100644
24--- a/plug-ins/common/file-pnm.c
25+++ b/plug-ins/common/file-pnm.c
26@@ -674,7 +674,7 @@ load_image (GFile *file,
27 GError **error)
28 {
29 GInputStream *input;
30- GeglBuffer *buffer;
31+ GeglBuffer *buffer = NULL;
32 GimpImage * volatile image = NULL;
33 GimpLayer *layer;
34 char buf[BUFLEN + 4]; /* buffer for random things like scanning */
35@@ -708,6 +708,9 @@ load_image (GFile *file,
36 g_object_unref (input);
37 g_free (pnminfo);
38
39+ if (buffer)
40+ g_object_unref (buffer);
41+
42 if (image)
43 gimp_image_delete (image);
44
45@@ -1060,6 +1063,7 @@ pnm_load_raw (PNMScanner *scan,
46 const Babl *format = NULL;
47 gint bpc;
48 guchar *data, *d;
49+ gsize data_size;
50 gushort *s;
51 gint x, y, i;
52 gint start, end, scanlines;
53@@ -1070,7 +1074,12 @@ pnm_load_raw (PNMScanner *scan,
54 bpc = 1;
55
56 /* No overflow as long as gimp_tile_height() < 1365 = 2^(31 - 18) / 6 */
57- data = g_new (guchar, gimp_tile_height () * info->xres * info->np * bpc);
58+ if (! g_size_checked_mul (&data_size, gimp_tile_height (), info->xres) ||
59+ ! g_size_checked_mul (&data_size, data_size, info->np) ||
60+ ! g_size_checked_mul (&data_size, data_size, bpc))
61+ CHECK_FOR_ERROR (FALSE, info->jmpbuf, _("Unsupported maximum value."));
62+
63+ data = g_new (guchar, data_size);
64
65 input = pnmscanner_input (scan);
66
diff --git a/meta-gnome/recipes-gimp/gimp/gimp/CVE-2025-14423.patch b/meta-gnome/recipes-gimp/gimp/gimp/CVE-2025-14423.patch
deleted file mode 100644
index 50a0adfe89..0000000000
--- a/meta-gnome/recipes-gimp/gimp/gimp/CVE-2025-14423.patch
+++ /dev/null
@@ -1,106 +0,0 @@
1From a83e8c4ad8ffbce40aa9f9a0f49880e802ef7da1 Mon Sep 17 00:00:00 2001
2From: Gyorgy Sarvari <skandigraun@gmail.com>
3Date: Sun, 23 Nov 2025 04:22:49 +0000
4Subject: [PATCH] plug-ins: Fix ZDI-CAN-28311
5
6From: Alx Sa <cmyk.student@gmail.com>
7
8Resolves #15292
9The IFF specification states that EHB format images
10have exactly 32 colors in their palette. However, it
11is possible for images in the wild to place an incorrect
12palette size. This patch checks for this, and either limits
13the palette size or breaks accordingly.
14
15CVE: CVE-2025-14423
16Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/gimp/-/commit/481cdbbb97746be1145ec3a633c567a68633c521]
17Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
18---
19 plug-ins/common/file-iff.c | 32 ++++++++++++++++++++++----------
20 1 file changed, 22 insertions(+), 10 deletions(-)
21
22diff --git a/plug-ins/common/file-iff.c b/plug-ins/common/file-iff.c
23index d144a96..f087947 100644
24--- a/plug-ins/common/file-iff.c
25+++ b/plug-ins/common/file-iff.c
26@@ -337,7 +337,7 @@ load_image (GFile *file,
27 width = bitMapHeader->w;
28 height = bitMapHeader->h;
29 nPlanes = bitMapHeader->nPlanes;
30- row_length = (width + 15) / 16;
31+ row_length = ((width + 15) / 16) * 2;
32 pixel_size = nPlanes / 8;
33 aspect_x = bitMapHeader->xAspect;
34 aspect_y = bitMapHeader->yAspect;
35@@ -375,6 +375,18 @@ load_image (GFile *file,
36 {
37 /* EHB mode adds 32 more colors. Each are half the RGB values
38 * of the first 32 colors */
39+ if (palette_size < 32)
40+ {
41+ g_set_error (error, G_FILE_ERROR,
42+ g_file_error_from_errno (errno),
43+ _("Invalid ILBM colormap size"));
44+ return NULL;
45+ }
46+ else if (palette_size > 32)
47+ {
48+ palette_size = 32;
49+ }
50+
51 for (gint j = 0; j < palette_size * 2; j++)
52 {
53 gint offset_index = j + 32;
54@@ -386,7 +398,7 @@ load_image (GFile *file,
55 gimp_cmap[offset_index * 3 + 2] =
56 colorMap->colorRegister[j].blue / 2;
57 }
58- /* EHB mode always has 64 colors */
59+ /* EHB mode always has 64 colors in total */
60 palette_size = 64;
61 }
62 }
63@@ -447,7 +459,7 @@ load_image (GFile *file,
64 {
65 guchar *pixel_row;
66
67- pixel_row = g_malloc (width * pixel_size * sizeof (guchar));
68+ pixel_row = g_malloc0 (width * pixel_size);
69
70 /* PBM uses one byte per pixel index */
71 if (ILBM_imageIsPBM (true_image))
72@@ -459,7 +471,7 @@ load_image (GFile *file,
73 else
74 deleave_rgb_row (bitplanes, pixel_row, width, nPlanes, pixel_size);
75
76- bitplanes += (row_length * 2 * nPlanes);
77+ bitplanes += (row_length * nPlanes);
78
79 gegl_buffer_set (buffer, GEGL_RECTANGLE (0, y_height, width, 1), 0,
80 NULL, pixel_row, GEGL_AUTO_ROWSTRIDE);
81@@ -528,7 +540,7 @@ deleave_ham_row (const guchar *gimp_cmap,
82 /* Deleave rows */
83 for (gint i = 0; i < row_length; i++)
84 {
85- for (gint j = 0; j < 8; j++)
86+ for (gint j = 0; j < nPlanes; j++)
87 {
88 guint8 bitmask = (1 << (8 - j)) - (1 << (7 - j));
89 guint8 control = 0;
90@@ -590,11 +602,11 @@ deleave_ham_row (const guchar *gimp_cmap,
91 }
92
93 static void
94-deleave_rgb_row (IFF_UByte *bitplanes,
95- guchar *pixel_row,
96- gint width,
97- gint nPlanes,
98- gint pixel_size)
99+deleave_rgb_row (IFF_UByte *bitplanes,
100+ guchar *pixel_row,
101+ gint width,
102+ gint nPlanes,
103+ gint pixel_size)
104 {
105 gint row_length = ((width + 15) / 16) * 2;
106 gint current_pixel = 0;
diff --git a/meta-gnome/recipes-gimp/gimp/gimp/CVE-2025-14424.patch b/meta-gnome/recipes-gimp/gimp/gimp/CVE-2025-14424.patch
deleted file mode 100644
index e7821d3109..0000000000
--- a/meta-gnome/recipes-gimp/gimp/gimp/CVE-2025-14424.patch
+++ /dev/null
@@ -1,34 +0,0 @@
1From d30875b606085316b1cb7ac1da0d26e5bac0cf2c Mon Sep 17 00:00:00 2001
2From: Gyorgy Sarvari <skandigraun@gmail.com>
3Date: Thu, 13 Nov 2025 18:26:51 -0500
4Subject: [PATCH] app: fix #15288 crash when loading malformed xcf
5
6From: Jacob Boerema <jgboerema@gmail.com>
7
8ZDI-CAN-28376 vulnerability
9
10Add extra tests to not crash on a NULL g_class.
11
12CVE: CVE-2025-14424
13Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/gimp/-/commit/5cc55d078b7fba995cef77d195fac325ee288ddd]
14Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
15---
16 app/core/gimpitemlist.c | 5 ++++-
17 1 file changed, 4 insertions(+), 1 deletion(-)
18
19diff --git a/app/core/gimpitemlist.c b/app/core/gimpitemlist.c
20index 6473938..a431519 100644
21--- a/app/core/gimpitemlist.c
22+++ b/app/core/gimpitemlist.c
23@@ -345,7 +345,10 @@ gimp_item_list_named_new (GimpImage *image,
24 g_return_val_if_fail (GIMP_IS_IMAGE (image), NULL);
25
26 for (iter = items; iter; iter = iter->next)
27- g_return_val_if_fail (g_type_is_a (G_OBJECT_TYPE (iter->data), item_type), NULL);
28+ {
29+ g_return_val_if_fail (iter->data && ((GTypeInstance*) (iter->data))->g_class, NULL);
30+ g_return_val_if_fail (g_type_is_a (G_OBJECT_TYPE (iter->data), item_type), NULL);
31+ }
32
33 if (! items)
34 {
diff --git a/meta-gnome/recipes-gimp/gimp/gimp/CVE-2025-14425.patch b/meta-gnome/recipes-gimp/gimp/gimp/CVE-2025-14425.patch
deleted file mode 100644
index 44e9587570..0000000000
--- a/meta-gnome/recipes-gimp/gimp/gimp/CVE-2025-14425.patch
+++ /dev/null
@@ -1,79 +0,0 @@
1From 042e27792026460badbe49664c02fe181e95cb2b Mon Sep 17 00:00:00 2001
2From: Gyorgy Sarvari <skandigraun@gmail.com>
3Date: Wed, 12 Nov 2025 13:25:44 +0000
4Subject: [PATCH] plug-ins: Mitigate ZDI-CAN-28248 for JP2 images
5
6From: Alx Sa <cmyk.student@gmail.com>
7
8Resolves #15285
9Per the report, it's possible to exceed the size of the pixel buffer
10with a high precision_scaled value, as we size it to the width * bpp.
11This patch includes precision_scaled in the allocation calculation.
12It also adds a g_size_checked_mul () check to ensure there's no
13overflow, and moves the pixel and buffer memory freeing to occur
14in the out section so that it always runs even on failure.
15
16CVE: CVE-2025-14425
17Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/gimp/-/commit/cd1c88a0364ad1444c06536731972a99bd8643fd]
18Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
19---
20 plug-ins/common/file-jp2-load.c | 23 ++++++++++++++++-------
21 1 file changed, 16 insertions(+), 7 deletions(-)
22
23diff --git a/plug-ins/common/file-jp2-load.c b/plug-ins/common/file-jp2-load.c
24index 064b616..604313a 100644
25--- a/plug-ins/common/file-jp2-load.c
26+++ b/plug-ins/common/file-jp2-load.c
27@@ -1045,14 +1045,15 @@ load_image (GimpProcedure *procedure,
28 GimpColorProfile *profile = NULL;
29 GimpImage *gimp_image = NULL;
30 GimpLayer *layer;
31+ GeglBuffer *buffer = NULL;
32+ guchar *pixels = NULL;
33+ gsize pixels_size;
34 GimpImageType image_type;
35 GimpImageBaseType base_type;
36 gint width;
37 gint height;
38 gint num_components;
39- GeglBuffer *buffer;
40 gint i, j, k, it;
41- guchar *pixels;
42 const Babl *file_format;
43 gint bpp;
44 GimpPrecision image_precision;
45@@ -1318,7 +1319,15 @@ load_image (GimpProcedure *procedure,
46 bpp = babl_format_get_bytes_per_pixel (file_format);
47
48 buffer = gimp_drawable_get_buffer (GIMP_DRAWABLE (layer));
49- pixels = g_new0 (guchar, width * bpp);
50+
51+ if (! g_size_checked_mul (&pixels_size, width, (bpp * (precision_scaled / 8))))
52+ {
53+ g_set_error (error, GIMP_PLUG_IN_ERROR, 0,
54+ _("Defined row size is too large in JP2 image '%s'."),
55+ gimp_file_get_utf8_name (file));
56+ goto out;
57+ }
58+ pixels = g_new0 (guchar, pixels_size);
59
60 for (i = 0; i < height; i++)
61 {
62@@ -1344,13 +1353,13 @@ load_image (GimpProcedure *procedure,
63 gegl_buffer_set (buffer, GEGL_RECTANGLE (0, i, width, 1), 0,
64 file_format, pixels, GEGL_AUTO_ROWSTRIDE);
65 }
66-
67- g_free (pixels);
68-
69- g_object_unref (buffer);
70 gimp_progress_update (1.0);
71
72 out:
73+ if (pixels)
74+ g_free (pixels);
75+ if (buffer)
76+ g_object_unref (buffer);
77 if (profile)
78 g_object_unref (profile);
79 if (image)
diff --git a/meta-gnome/recipes-gimp/gimp/gimp_3.0.6.bb b/meta-gnome/recipes-gimp/gimp/gimp_3.0.8.bb
index fa192555bc..a5e892c508 100644
--- a/meta-gnome/recipes-gimp/gimp/gimp_3.0.6.bb
+++ b/meta-gnome/recipes-gimp/gimp/gimp_3.0.8.bb
@@ -46,7 +46,7 @@ DEPENDS:append:libc-musl = " libexecinfo"
46 46
47LDFLAGS:append:libc-musl = " -lexecinfo" 47LDFLAGS:append:libc-musl = " -lexecinfo"
48 48
49inherit meson gtk-icon-cache mime-xdg pkgconfig gettext gobject-introspection vala 49inherit meson gtk-icon-cache mime-xdg pkgconfig gettext gobject-introspection vala bash-completion
50 50
51GIR_MESON_OPTION = 'can-crosscompile-gir' 51GIR_MESON_OPTION = 'can-crosscompile-gir'
52VALA_MESON_OPTION = "vala" 52VALA_MESON_OPTION = "vala"
@@ -57,16 +57,11 @@ GIDOCGEN_MESON_ENABLE_FLAG = "enabled"
57GIDOCGEN_MESON_DISABLE_FLAG = "disabled" 57GIDOCGEN_MESON_DISABLE_FLAG = "disabled"
58 58
59SRC_URI = "https://download.gimp.org/gimp/v3.0/${BP}.tar.xz \ 59SRC_URI = "https://download.gimp.org/gimp/v3.0/${BP}.tar.xz \
60 file://0001-gimp-cross-compile-fix-for-bz2.patch \
61 file://0002-meson.build-reproducibility-fix.patch \ 60 file://0002-meson.build-reproducibility-fix.patch \
62 file://0001-meson.build-dont-check-for-lgi.patch \ 61 file://0001-meson.build-dont-check-for-lgi.patch \
63 file://0001-meson.build-require-iso-codes-native.patch \ 62 file://0001-meson.build-require-iso-codes-native.patch \
64 file://CVE-2025-14422.patch \
65 file://CVE-2025-14423.patch \
66 file://CVE-2025-14424.patch \
67 file://CVE-2025-14425.patch \
68 " 63 "
69SRC_URI[sha256sum] = "246c225383c72ef9f0dc7703b7d707084bbf177bd2900e94ce466a62862e296b" 64SRC_URI[sha256sum] = "feb498acc01b26827cff1ff95aa8fb82cdd6a60d7abf773cfcd19abeafca3386"
70 65
71PACKAGECONFIG[aa] = "-Daa=enabled,-Daa=disabled,aalib" 66PACKAGECONFIG[aa] = "-Daa=enabled,-Daa=disabled,aalib"
72PACKAGECONFIG[alsa] = "-Dalsa=enabled,-Dalsa=disabled,alsa-lib" 67PACKAGECONFIG[alsa] = "-Dalsa=enabled,-Dalsa=disabled,alsa-lib"
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-04-23 00:29:57 +0000