Resolves#16151
The original implementation mixed up the variable that
needed to be used for boundary checks - it should be
"estimated_size" and not "flags". This patch fixes the issue
to prevent a buffer overflow.
Resolves#16150
Per Bronson Yen, it's possible to create a transparent chunk
that's larger than 256 index values. In that case, the trans[]
array will overflow since we initialize it to 256 indexes.
This patch adds a check to make sure the iterator used for the
transparency for loop does not exceed the array size even if
the chunk size does.
There are reports that clang-based compilers create
a TIM plug-in that crashes when exporting. This seems
related to the method used to convert RGB images to
indexed when choosing TIM textures with palettes on export.
This patch switches to using gimp-image-convert-indexed
instead, to prevent the format mismatch crash on initial export.
Previously, paths from Photoshop TIFF files were appended via
gimp_image_insert_path(..., -1), which caused the displayed order to be
reversed. This change preserves the original ordering while keeping the
'Working Path' as the last element.
When loading layer metadata from TIFF 'ImageSourceData' Tag, don't assume
'Layr' is the first 8BIM block. Iterate over 8BIM/MIB8 blocks, skip non
'Layr' blocks, and rewind 4 bytes before calling read_layer_block() so it
can read the length field as expected. Limit mask_layer_len to the
selected block (including padding).
Multichannel PSD images reuse their first channel as the
main grayscale "layer". Our PSD plug-in did not take this
into account, resulting in the channels being off-by-one and
mislabeled.
This patch prevents chn_a[0].data from being freed after
it is used to load the layer, and then resets the counts so that
it is reused as the first imported channel.
968cf06a only loaded the rectangle area that the
selection was contained in, rather than the actual
channel data. This patch extended the code to
also read in the PSP_CHANNEL_BLOCK data, add
it to the selection GeglBuffer, and then shift it over
into the correct location.
Resolves#16076
As reported by chamal, it is possible to craft a
Jeff's Image Format image with header values that
are larger than the file size. This can lead to buffer
overflows when loading the data. This patch adds
bounding checks based on the size of the stream.
Resolves#16075
As noted by chamal, it is possible to cause a buffer overflow
in a crafted SFW file. This patch adds bounds checks to prevent
this from occurring.
Resolves#16058
Per mzfr's observations, this patch adds more
safeguards to PVR import. Memory for data and pixels
is allocated and checked rather than using arrays.
Twiddled patterns are increased to 2048 and we
verify the dimensions are in that range before trying
to access. If users share an image that is larger than
that, we can increase this limit further.
Resolves#16056
Per mzfr, we should check if the cursor exceeds the
icon total size in icns_slurp () (per OSX icons) as we
do already in icns_decompress ().
Additionally, we were not deleting the temp_image created
to load each icon, and in fact we were making an unnecessary
blank temp_image before receiving the one from the PNG &
JPEG2000 procedures. This patch fixes both problems.
Per mzfr, we should dynamically allocate memory
for the PAA plug-in pixel data rather than rely on the image
being small enough for an array to store its information.
Resolves#16052
Per mzfr, the pixel array for 4bpp TIM textures needs to
be allocated twice as large since each byte in the file
stores two pixel indexes when opened.
Resolves#16051
As reported by mzfr, it is possible to crash the FITS plug-in
if a large enough image is read in. This patch implements their
suggestions of using g_try_malloc () over malloc () (and checking
if it returns NULL), as well as verifying the width & height are
within GIMP's image range.
Resolves#5553
As noted by Massimo, in the Sparkle plug-in there is an
extra gegl_buffer_iterator_add () that is not used in the following
gegl_buffer_iterator_next (iter) loop. Since this adds dest_buffer
which is also written to in the loop in the fspike () functions,
it can cause data to be overwritten. This patch removes the
unneeded extra function call.
It is long-time unmaintained on our repo, with no issues being fixed. Now that
32-bit binaries are not distributed, we can safely move to unmaintained section.
If the user chooses to make a new image when
running the Tile plug-in, the color profile is not
carried over. This can result in the tiled image
looking different. This patch adds calls to
gimp_image_get_color_profile () and
gimp_image_set_color_profile () to ensure the
profile is carried over.
Some JPEGs contain large Photoshop path metadata split across multiple APP13 markers. Collect all APP13 payloads and skip the repeated "Photoshop 3.0\0" identifier for subsequent segments so the metadata can be parsed as a single stream.
