Script 'mail_helper' called by obssrc
Hello community,
here is the log from the commit of package GraphicsMagick for openSUSE:Factory
checked in at 2026-10-09 21:42:39
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/GraphicsMagick (Old)
and /work/SRC/openSUSE:Factory/.GraphicsMagick.new.3698736 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "GraphicsMagick"
Fri Oct 9 21:42:39 2026 rev:111 rq:1383238 version:1.3.48
Changes:
--------
--- /work/SRC/openSUSE:Factory/GraphicsMagick/GraphicsMagick.changes
2026-09-07 11:28:12.349647164 +0200
+++
/work/SRC/openSUSE:Factory/.GraphicsMagick.new.3698736/GraphicsMagick.changes
2026-10-09 21:42:51.804968119 +0200
@@ -1,0 +2,7 @@
+Thu Oct 8 07:38:45 UTC 2026 - Petr Gajdos <[email protected]>
+
+- added patches
+ CVE-2026-103118: uncontrolled recursion in the WPG file handler when
processing crafted WPG files which are self-referencing [bsc#1283767]
+ * GraphicsMagick-CVE-2026-103118.patch
+
+-------------------------------------------------------------------
New:
----
GraphicsMagick-CVE-2026-103118.patch
----------(New B)----------
New: CVE-2026-103118: uncontrolled recursion in the WPG file handler when
processing crafted WPG files which are self-referencing [bsc#1283767]
* GraphicsMagick-CVE-2026-103118.patch
----------(New E)----------
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ GraphicsMagick.spec ++++++
--- /var/tmp/diff_new_pack.ZeQy8K/_old 2026-10-09 21:42:52.810010241 +0200
+++ /var/tmp/diff_new_pack.ZeQy8K/_new 2026-10-09 21:42:52.813010366 +0200
@@ -41,6 +41,8 @@
Patch12: GraphicsMagick-CVE-2026-56379.patch
# CVE-2025-55154: integer overflow when performing magnified size calculations
in ReadOneMNGIMage can lead to out-of-bounds write [bsc#1248078]
Patch13: GraphicsMagick-CVE-2025-55154.patch
+# CVE-2026-103118: uncontrolled recursion in the WPG file handler when
processing crafted WPG files which are self-referencing [bsc#1283767]
+Patch14: GraphicsMagick-CVE-2026-103118.patch
BuildRequires: cups-client
BuildRequires: dcraw
BuildRequires: gcc-c++
++++++ GraphicsMagick-CVE-2026-103118.patch ++++++
# HG changeset patch
# User Bob Friesenhahn <[email protected]>
# Date 1787611781 18000
# Mon Aug 24 17:49:41 2026 -0500
# Node ID 627b5b1b2fc2873550fde7777c9796ad001f89cc
# Parent 633475b4626443e76ad55b02be48099cbaf14e0a
coders/wpg.c (ReadWPGImage): Limit recursion under ExtractPostscript() to avoid
stack exhaustion given crafted WPG files which are self-referencing or
otherwise create loops.
Index: GraphicsMagick-1.3.48/coders/wpg.c
===================================================================
--- GraphicsMagick-1.3.48.orig/coders/wpg.c
+++ GraphicsMagick-1.3.48/coders/wpg.c
@@ -45,11 +45,23 @@
#include "magick/pixel_cache.h"
#include "magick/shear.h"
#include "magick/tempfile.h"
+#include "magick/tsd.h"
#include "magick/transform.h"
#include "magick/quantize.h"
#include "magick/utility.h"
#include "magick/static.h"
+/*
+ Global declarations.
+*/
+#define ExtractPostscriptRecursionLimit 64
+static MagickTsdKey_t tsd_key = (MagickTsdKey_t) 0;
+
+
+typedef struct
+{
+ size_t ps_recursion;
+} WPG_TSD;
typedef struct
{
@@ -847,6 +859,9 @@ static Image *ExtractPostscript(Image *i
Image
*image2;
+ WPG_TSD
+ *tsd;
+
unsigned char
header_magick[2*MaxTextExtent];
@@ -868,6 +883,7 @@ static Image *ExtractPostscript(Image *i
"ExtractPostscript(): PS_Offset=%" MAGICK_OFF_F "d,
PS_Size=%" MAGICK_SIZE_T_F "u",
(magick_off_t) PS_Offset, (MAGICK_SIZE_T) PS_Size);
+
/*
Validate that claimed subordinate image data is contained in file size
*/
@@ -992,6 +1008,42 @@ static Image *ExtractPostscript(Image *i
SeekBlob(image,PS_Offset,SEEK_SET);
}
#endif
+
+ /*
+ Support detecting the case where the "Postscript" blob is an
+ embedded WPG which is self-referencing or is otherwise constructed
+ to produce non-terminal looping. If recursion occurs, it will
+ occur under BlobToImage.
+ */
+ tsd = (WPG_TSD *) MagickTsdGetSpecific(tsd_key);
+ if (tsd == (WPG_TSD *) NULL)
+ {
+ /*
+ Allocate and set thread specific data
+ */
+ tsd = MagickMallocCleared(sizeof(WPG_TSD));
+ if (tsd == (WPG_TSD *) NULL)
+ {
+
ThrowException(exception,ResourceLimitError,MemoryAllocationFailed,image->filename);
+ return image;
+ }
+ tsd->ps_recursion = 0;
+ (void) MagickTsdSetSpecific(tsd_key,(void *) tsd);
+ }
+ tsd->ps_recursion++;
+ if (image->logging)
+ (void) LogMagickEvent(CoderEvent,GetMagickModule(),
+ "Recursion level %" MAGICK_SIZE_T_F "u",
tsd->ps_recursion);
+ if (tsd->ps_recursion > ExtractPostscriptRecursionLimit)
+ {
+ if (image->logging)
+ (void) LogMagickEvent(CoderEvent,GetMagickModule(),
+ "Excessive recursion detected!");
+ ThrowException(exception,CorruptImageError,CorruptImage,image->filename);
+ MagickFreeResourceLimitedMemory(unsigned char *,ps_data_alloc);
+ return image;
+ }
+
/*
Read nested image from blob, forcing read as Postscript format
*/
@@ -1000,13 +1052,18 @@ static Image *ExtractPostscript(Image *i
MagickFreeResourceLimitedMemory(unsigned char *,ps_data_alloc);
return(image);
}
+
clone_info->blob=(void *) NULL;
/* clone_info->length=0; */
(void) strlcpy(clone_info->magick, format, sizeof(clone_info->magick));
(void) strlcpy(clone_info->filename, "", sizeof(clone_info->filename));
(void) LogMagickEvent(CoderEvent,GetMagickModule(),
"Reading embedded \"%s\" content from blob...",
clone_info->magick);
- image2 = BlobToImage(clone_info, ps_data, PS_Size, &image->exception );
+ image2 = BlobToImage(clone_info, ps_data, PS_Size, exception );
+ tsd->ps_recursion--;
+ if (image->logging)
+ (void) LogMagickEvent(CoderEvent,GetMagickModule(),
+ "Recursion level %" MAGICK_SIZE_T_F "u",
tsd->ps_recursion);
MagickFreeResourceLimitedMemory(unsigned char *,ps_data_alloc);
if (!image2)
{
@@ -2354,6 +2411,15 @@ ModuleExport void RegisterWPGImage(void)
MagickInfo
*entry;
+ /*
+ Initialize thread specific data key with destructor.
+
+ Thread-specific allocations are freed using the specified
+ destructor function when the thread is destroyed.
+ */
+ if (tsd_key == (MagickTsdKey_t) 0)
+ (void) MagickTsdKeyCreate2(&tsd_key,MagickFree);
+
entry=SetMagickInfo("WPG");
entry->decoder=(DecoderHandler) ReadWPGImage;
entry->encoder = (EncoderHandler)WriteWPGImage;
