[rpms/gdk-pixbuf2] f45: Fix CVE-2026-16768

[rpms/gdk-pixbuf2] f45: Fix CVE-2026-16768

[Adrian Vovk]

A new commit has been pushed.

Repo   : rpms/gdk-pixbuf2
Branch : f45
Commit : 042b3e053708b7d771c280685028ab217105d1cb
Author : Adrian Vovk <avovk@redhat.com>
Date   : 2026-08-26T16:13:19-04:00
Stats  : +102/-0 in 2 file(s)
URL    : https://src.fedoraproject.org/rpms/gdk-pixbuf2/c/042b3e053708b7d771c280685028ab217105d1cb?branch=f45

Log:
Fix CVE-2026-16768

---
diff --git a/CVE-2026-16768.patch b/CVE-2026-16768.patch
new file mode 100644
index 0000000..5ca2d2e
--- /dev/null
+++ b/CVE-2026-16768.patch
@@ -0,0 +1,100 @@
+From 2663fccc4235eab4b455fce48c3e3b0073e838e0 Mon Sep 17 00:00:00 2001
+From: Adrian Vovk <adrianvovk@gmail.com>
+Date: Wed, 26 Aug 2026 15:57:11 -0400
+Subject: [PATCH] ico: Protect against out-of-bounds palette index
+
+We previously didn't check that the palette indices in the pixel data
+referred to palette colors that actually exist. A malformed ICO file
+could thus trick gdk-pixbuf into reading past the end of the palette
+data and leaking heap memory.
+
+Closes: #302
+Fixes: CVE-2026-16768
+---
+ gdk-pixbuf/io-ico.c | 33 +++++++++++++++++++++++----------
+ 1 file changed, 23 insertions(+), 10 deletions(-)
+
+diff --git a/gdk-pixbuf/io-ico.c b/gdk-pixbuf/io-ico.c
+index 2523c0803..21008307f 100644
+--- a/gdk-pixbuf/io-ico.c
++++ b/gdk-pixbuf/io-ico.c
+@@ -725,6 +725,7 @@ static void OneLine8(struct ico_progressive_state *context)
+ 	gint X;
+ 	guchar *Pixels;
+ 	gsize rowstride = gdk_pixbuf_get_rowstride (context->pixbuf);
++	gint palette_size = (context->HeaderSize - INFOHEADER_SIZE - context->DIBoffset) / 4;
+ 
+ 	X = 0;
+ 	if (context->Header.Negative == 0)
+@@ -734,13 +735,17 @@ static void OneLine8(struct ico_progressive_state *context)
+ 		Pixels = (gdk_pixbuf_get_pixels (context->pixbuf) +
+ 			  rowstride * context->Lines);
+ 	while (X < context->Header.width) {
++		guint8 idx = context->LineBuf[X];
++		if (idx >= palette_size)
++			idx = 0;
++
+ 		/* The joys of having a BGR byteorder */
+ 		Pixels[X * 4 + 0] =
+-		    context->HeaderBuf[4 * context->LineBuf[X] + INFOHEADER_SIZE + 2 + context->DIBoffset];
++		    context->HeaderBuf[4 * idx + INFOHEADER_SIZE + 2 + context->DIBoffset];
+ 		Pixels[X * 4 + 1] =
+-		    context->HeaderBuf[4 * context->LineBuf[X] + INFOHEADER_SIZE + 1 +context->DIBoffset];
++		    context->HeaderBuf[4 * idx + INFOHEADER_SIZE + 1 +context->DIBoffset];
+ 		Pixels[X * 4 + 2] =
+-		    context->HeaderBuf[4 * context->LineBuf[X] + INFOHEADER_SIZE +context->DIBoffset];
++		    context->HeaderBuf[4 * idx + INFOHEADER_SIZE +context->DIBoffset];
+ 		Pixels[X * 4 + 3] = 0xff;
+ 		X++;
+ 	}
+@@ -750,6 +755,7 @@ static void OneLine4(struct ico_progressive_state *context)
+ 	gint X;
+ 	guchar *Pixels;
+ 	gsize rowstride = gdk_pixbuf_get_rowstride (context->pixbuf);
++	gint palette_size = (context->HeaderSize - INFOHEADER_SIZE - context->DIBoffset) / 4;
+ 
+ 	X = 0;
+ 	if (context->Header.Negative == 0)
+@@ -761,25 +767,32 @@ static void OneLine4(struct ico_progressive_state *context)
+ 	
+ 	while (X < context->Header.width) {
+ 		guchar Pix;
++		guint8 idx;
+ 		
+ 		Pix = context->LineBuf[X/2];
++		idx = Pix >> 4;
++		if (idx >= palette_size)
++			idx = 0;
+ 
+ 		Pixels[X * 4 + 0] =
+-		    context->HeaderBuf[4 * (Pix>>4) + INFOHEADER_SIZE + 2 + context->DIBoffset];
++		    context->HeaderBuf[4 * idx + INFOHEADER_SIZE + 2 + context->DIBoffset];
+ 		Pixels[X * 4 + 1] =
+-		    context->HeaderBuf[4 * (Pix>>4) + INFOHEADER_SIZE + 1 +context->DIBoffset];
++		    context->HeaderBuf[4 * idx + INFOHEADER_SIZE + 1 +context->DIBoffset];
+ 		Pixels[X * 4 + 2] =
+-		    context->HeaderBuf[4 * (Pix>>4) + INFOHEADER_SIZE + context->DIBoffset];
++		    context->HeaderBuf[4 * idx + INFOHEADER_SIZE + context->DIBoffset];
+ 		Pixels[X * 4 + 3] = 0xff;
+ 		X++;
+-		if (X<context->Header.width) { 
++		if (X<context->Header.width) {
+ 			/* Handle the other 4 bit pixel only when there is one */
++			idx = Pix & 15;
++			if (idx >= palette_size)
++				idx = 0;
+ 			Pixels[X * 4 + 0] =
+-			    context->HeaderBuf[4 * (Pix&15) + INFOHEADER_SIZE + 2 + context->DIBoffset];
++			    context->HeaderBuf[4 * idx + INFOHEADER_SIZE + 2 + context->DIBoffset];
+ 			Pixels[X * 4 + 1] =
+-			    context->HeaderBuf[4 * (Pix&15) + INFOHEADER_SIZE + 1 + context->DIBoffset];
++			    context->HeaderBuf[4 * idx + INFOHEADER_SIZE + 1 + context->DIBoffset];
+ 			Pixels[X * 4 + 2] =
+-			    context->HeaderBuf[4 * (Pix&15) + INFOHEADER_SIZE + context->DIBoffset];
++			    context->HeaderBuf[4 * idx + INFOHEADER_SIZE + context->DIBoffset];
+ 			Pixels[X * 4 + 3] = 0xff;
+ 			X++;
+ 		}
+-- 
+GitLab
+

diff --git a/gdk-pixbuf2.spec b/gdk-pixbuf2.spec
index 78de6e1..3ee9cc4 100644
--- a/gdk-pixbuf2.spec
+++ b/gdk-pixbuf2.spec
@@ -15,6 +15,8 @@ License:        LGPL-2.1-or-later
 URL:            https://gitlab.gnome.org/GNOME/gdk-pixbuf
 Source0:        https://download.gnome.org/sources/gdk-pixbuf/%{gnome_major_minor_version}/gdk-pixbuf-%{version}.tar.xz
 
+Patch0:         CVE-2026-16768.patch
+
 BuildRequires:  docbook-style-xsl
 BuildRequires:  gettext
 BuildRequires:  gi-docgen