From 5203f996b5eb018fd08e8e99e42b28f42ef27533 Mon Sep 17 00:00:00 2001 From: Alx Sa Date: Sat, 23 Sep 2023 02:16:24 +0000 Subject: plug-ins: Fix PSP vulnerability (ZDI-CAN-22097) Resolves #10071. When reading RLE compressed data, a buffer was allocated to 127 bytes. However, it can potentially be used to read 128 bytes, leading to a off-by-one vulnerability. This patch allocates 128 bytes to the buffer to prevent this from occurring. Origin: https://gitlab.gnome.org/GNOME/gimp/-/commit/e1bfd87195e4fe60a92df70cde65464d032dd3c1 --- plug-ins/common/file-psp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/plug-ins/common/file-psp.c b/plug-ins/common/file-psp.c index 33c6a2b607..f3aa00fdc0 100644 --- a/plug-ins/common/file-psp.c +++ b/plug-ins/common/file-psp.c @@ -1235,7 +1235,7 @@ read_channel_data (FILE *f, q = pixels[0] + offset; endq = q + npixels * bytespp; - buf = g_malloc (127); + buf = g_malloc (128); while (q < endq) { fread (&runcount, 1, 1, f); -- 2.30.2