Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package gimp for openSUSE:Factory checked in at 2026-09-04 12:36:12 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/gimp (Old) and /work/SRC/openSUSE:Factory/.gimp.new.1265 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "gimp" Fri Sep 4 12:36:12 2026 rev:171 rq:1375015 version:3.2.4 Changes: -------- --- /work/SRC/openSUSE:Factory/gimp/gimp.changes 2026-08-19 17:56:11.907428411 +0200 +++ /work/SRC/openSUSE:Factory/.gimp.new.1265/gimp.changes 2026-09-04 12:36:46.873937413 +0200 @@ -1,0 +2,7 @@ +Mon Aug 31 19:57:01 UTC 2026 - Michael Gorse <[email protected]> + +- Replace gimp-CVE-2026-66757.patch with the upstream backport. +- Add gimp-CVE-2026-66757-2.patch: fix allocation of SGI tables + (glgo#GNOME/gimp!2984). + +------------------------------------------------------------------- New: ---- gimp-CVE-2026-66757-2.patch ----------(New B)---------- New:- Replace gimp-CVE-2026-66757.patch with the upstream backport. - Add gimp-CVE-2026-66757-2.patch: fix allocation of SGI tables (glgo#GNOME/gimp!2984). ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ gimp.spec ++++++ --- /var/tmp/diff_new_pack.Dj8yZX/_old 2026-09-04 12:36:48.385990501 +0200 +++ /var/tmp/diff_new_pack.Dj8yZX/_new 2026-09-04 12:36:48.387990571 +0200 @@ -117,6 +117,8 @@ Patch11: gimp-CVE-2026-59090.patch # PATCH-FIX-UPSTREAM gimp-CVE-2026-59091.patch bsc#1274851, glgo#GNOME/gimp#16510 [email protected] -- Fix multiple vulnerabilities in file format plugins via crafted image file Patch12: gimp-CVE-2026-59091.patch +# PATCH-FIX-UPSTREAM gimp-CVE-2026-66757-2.patch bsc#1273151 [email protected] -- fix allocation of SGI tables. +Patch13: gimp-CVE-2026-66757-2.patch %if %{with debug_in_build_gimp} BuildRequires: gdb %endif ++++++ gimp-CVE-2026-66757-2.patch ++++++ diff -urp gimp-3.2.4.orig/plug-ins/file-sgi/sgi-lib.c gimp-3.2.4/plug-ins/file-sgi/sgi-lib.c --- gimp-3.2.4.orig/plug-ins/file-sgi/sgi-lib.c 2026-08-31 14:51:29.317145550 -0500 +++ gimp-3.2.4/plug-ins/file-sgi/sgi-lib.c 2026-08-31 14:55:47.930536387 -0500 @@ -338,7 +338,7 @@ sgiOpenFile(FILE *file, /* I - File to o free(sgip); return (NULL); } - sgip->table[0] = g_try_malloc ((gsize) sgip->ysize * sgip->zsize * 4); + sgip->table[0] = g_try_malloc ((gsize) sgip->ysize * sgip->zsize * sizeof(goffset)); if (sgip->table[0] == NULL) { free(sgip->table); @@ -439,7 +439,7 @@ sgiOpenFile(FILE *file, /* I - File to o return (NULL); } sgip->table[0] = - g_try_malloc ((gsize) sgip->ysize * sgip->zsize * 4); + g_try_malloc ((gsize) sgip->ysize * sgip->zsize * sizeof(goffset)); if (sgip->table[0] == NULL) { free(sgip->table); @@ -451,7 +451,7 @@ sgiOpenFile(FILE *file, /* I - File to o sgip->table[i] = sgip->table[0] + i * sgip->ysize; sgip->length = calloc(sgip->zsize, sizeof(long *)); sgip->length[0] = - g_try_malloc ((gsize) sgip->ysize * sgip->zsize * 4); + g_try_malloc ((gsize) sgip->ysize * sgip->zsize * sizeof(goffset)); for (i = 1; i < sgip->zsize; i ++) sgip->length[i] = sgip->length[0] + i * sgip->ysize; break; ++++++ gimp-CVE-2026-66757.patch ++++++ --- /var/tmp/diff_new_pack.Dj8yZX/_old 2026-09-04 12:36:48.459993099 +0200 +++ /var/tmp/diff_new_pack.Dj8yZX/_new 2026-09-04 12:36:48.462993204 +0200 @@ -1,4 +1,4 @@ -From adb89f0f2c086240fc49f6e2c946d89e10b66a70 Mon Sep 17 00:00:00 2001 +From 0d1d937521e4f6247f85bcb022ba0b358a6220e2 Mon Sep 17 00:00:00 2001 From: Alx Sa <[email protected]> Date: Tue, 16 Jun 2026 09:21:37 +0000 Subject: [PATCH] plug-ins: Mitigate issue #16494 @@ -10,15 +10,17 @@ to a larger datatype size. We also switch from calloc () to g_try_malloc () to better handle out-of-memory allocation problems. + +(cherry picked from commit 672db3cebbce935bd22e6f20379a908769dee6ca) --- plug-ins/file-sgi/sgi-lib.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) -Index: gimp-3.2.4/plug-ins/file-sgi/sgi-lib.c -=================================================================== ---- gimp-3.2.4.orig/plug-ins/file-sgi/sgi-lib.c -+++ gimp-3.2.4/plug-ins/file-sgi/sgi-lib.c -@@ -338,7 +338,7 @@ sgiOpenFile(FILE *file, /* I - File to o +diff --git a/plug-ins/file-sgi/sgi-lib.c b/plug-ins/file-sgi/sgi-lib.c +index 73255f3220..36f11c0b7f 100644 +--- a/plug-ins/file-sgi/sgi-lib.c ++++ b/plug-ins/file-sgi/sgi-lib.c +@@ -344,7 +344,7 @@ sgiOpenFile(FILE *file, /* I - File to open */ free(sgip); return (NULL); } @@ -27,7 +29,7 @@ if (sgip->table[0] == NULL) { free(sgip->table); -@@ -438,7 +438,8 @@ sgiOpenFile(FILE *file, /* I - File to o +@@ -444,7 +444,8 @@ sgiOpenFile(FILE *file, /* I - File to open */ free(sgip); return (NULL); } @@ -37,7 +39,7 @@ if (sgip->table[0] == NULL) { free(sgip->table); -@@ -449,7 +450,8 @@ sgiOpenFile(FILE *file, /* I - File to o +@@ -455,7 +456,8 @@ sgiOpenFile(FILE *file, /* I - File to open */ for (i = 1; i < sgip->zsize; i ++) sgip->table[i] = sgip->table[0] + i * sgip->ysize; sgip->length = calloc(sgip->zsize, sizeof(long *)); @@ -47,4 +49,7 @@ for (i = 1; i < sgip->zsize; i ++) sgip->length[i] = sgip->length[0] + i * sgip->ysize; break; +-- +2.55.0 +
