diff mbox series

[meta-gnome,kirkstone,1/3] gimp: patch CVE-2023-44441

Message ID 20260309182100.717697-1-skandigraun@gmail.com
State New
Headers show
Series [meta-gnome,kirkstone,1/3] gimp: patch CVE-2023-44441 | expand

Commit Message

Gyorgy Sarvari March 9, 2026, 6:20 p.m. UTC 
Details: https://nvd.nist.gov/vuln/detail/CVE-2023-44441

Backport the commit that resolved the related upstream issue[1].

[1]: https://gitlab.gnome.org/GNOME/gimp/-/issues/10069

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
---
 .../gimp/gimp/CVE-2023-44441.patch            | 61 +++++++++++++++++++
 meta-gnome/recipes-gimp/gimp/gimp_2.10.30.bb  |  1 +
 2 files changed, 62 insertions(+)
 create mode 100644 meta-gnome/recipes-gimp/gimp/gimp/CVE-2023-44441.patch
diff mbox series

Patch

diff --git a/meta-gnome/recipes-gimp/gimp/gimp/CVE-2023-44441.patch b/meta-gnome/recipes-gimp/gimp/gimp/CVE-2023-44441.patch
new file mode 100644
index 0000000000..d28cb1e848
--- /dev/null
+++ b/meta-gnome/recipes-gimp/gimp/gimp/CVE-2023-44441.patch
@@ -0,0 +1,61 @@ 
+From babb323270a37091604bec44ee3597150cac8227 Mon Sep 17 00:00:00 2001
+From: Alx Sa <cmyk.student@gmail.com>
+Date: Sun, 1 Oct 2023 17:54:08 +0000
+Subject: [PATCH] plug-ins: Fix DDS vulnerability (ZDI-CAN-22093)
+
+Resolves #10069
+
+Currently, the DDS header information for the width, height, and bytes per scan line
+are read in and assumed to be correct. As these values are used for memory allocation
+and reading, it would be good to verify they do not exceed the file size.
+
+This patch adds a condition after the header is read in to verify those values. If they exceed
+the file size (mins an offset), the file is not read in and an error message is shown.
+
+CVE: CVE-2023-44441
+Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/gimp/-/commit/7db71cd0b6e36c454aa0d2d3efeec7e636db4dbc]
+Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
+---
+ plug-ins/file-dds/ddsread.c | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+diff --git a/plug-ins/file-dds/ddsread.c b/plug-ins/file-dds/ddsread.c
+index a8eb8b8..98e122d 100644
+--- a/plug-ins/file-dds/ddsread.c
++++ b/plug-ins/file-dds/ddsread.c
+@@ -109,6 +109,7 @@ read_dds (gchar    *filename,
+   guchar *pixels;
+   gchar *tmp;
+   FILE *fp;
++  gsize file_size;
+   dds_header_t hdr;
+   dds_header_dx10_t dx10hdr;
+   dds_load_info_t d;
+@@ -130,6 +131,10 @@ read_dds (gchar    *filename,
+       return GIMP_PDB_EXECUTION_ERROR;
+     }
+ 
++  fseek (fp, 0L, SEEK_END);
++  file_size = ftell (fp);
++  fseek (fp, 0, SEEK_SET);
++
+   if (strrchr (filename, '/'))
+     tmp = g_strdup_printf ("Loading %s:", strrchr (filename, '/') + 1);
+   else
+@@ -186,6 +191,16 @@ read_dds (gchar    *filename,
+         }
+     }
+ 
++  /* verify header information is accurate */
++  if (hdr.depth < 1                                       ||
++      (hdr.pitch_or_linsize > (file_size - sizeof (hdr))) ||
++      (((guint64) hdr.height * hdr.width * hdr.depth) > (file_size - sizeof (hdr))))
++    {
++      fclose (fp);
++      g_message ("Invalid or corrupted DDS header\n");
++      return GIMP_PDB_EXECUTION_ERROR;
++    }
++
+   if (hdr.pixelfmt.flags & DDPF_FOURCC)
+     {
+       /* fourcc is dXt* or rXgb */
diff --git a/meta-gnome/recipes-gimp/gimp/gimp_2.10.30.bb b/meta-gnome/recipes-gimp/gimp/gimp_2.10.30.bb
index 4d2771e551..124760651d 100644
--- a/meta-gnome/recipes-gimp/gimp/gimp_2.10.30.bb
+++ b/meta-gnome/recipes-gimp/gimp/gimp_2.10.30.bb
@@ -48,6 +48,7 @@  SRC_URI = "https://download.gimp.org/pub/${BPN}/v${SHPV}/${BP}.tar.bz2 \
            file://CVE-2022-32990-1.patch \
            file://CVE-2022-32990-2.patch \
            file://CVE-2022-32990-3.patch \
+           file://CVE-2023-44441.patch \
            "
 SRC_URI[sha256sum] = "88815daa76ed7d4277eeb353358bafa116cd2fcd2c861d95b95135c1d52b67dc"