[rpms/gdk-pixbuf2] f45: Fix CVE-2026-81893

[rpms/gdk-pixbuf2] f45: Fix CVE-2026-81893

[Adrian Vovk]

A new commit has been pushed.

Repo   : rpms/gdk-pixbuf2
Branch : f45
Commit : fc03231c34be370e4c035a73c069d8614ca2a2f1
Author : Adrian Vovk <avovk@redhat.com>
Date   : 2026-08-31T17:25:29-04:00
Stats  : +34/-0 in 2 file(s)
URL    : https://src.fedoraproject.org/rpms/gdk-pixbuf2/c/fc03231c34be370e4c035a73c069d8614ca2a2f1?branch=f45

Log:
Fix CVE-2026-81893

---
diff --git a/CVE-2026-81893.patch b/CVE-2026-81893.patch
new file mode 100644
index 0000000..26994a3
--- /dev/null
+++ b/CVE-2026-81893.patch
@@ -0,0 +1,33 @@
+From efe658674bd103d1c9bf50809d5767a3f6dd5a01 Mon Sep 17 00:00:00 2001
+From: Benjamin Otte <otte@redhat.com>
+Date: Wed, 5 Aug 2026 18:19:01 +0200
+Subject: [PATCH] jpeg: When freeing memory, unset the size
+
+Fixes potential invalid write if a specifically crafted JPEG file
+would use markers to:
+
+1. cause memory to be allocated
+2. cause it to be freed due to an error
+3. cause memory to be allocated again
+
+I did not attempt to craft such a file.
+---
+ gdk-pixbuf/io-jpeg.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/gdk-pixbuf/io-jpeg.c b/gdk-pixbuf/io-jpeg.c
+index a225998b1..8434fd00d 100644
+--- a/gdk-pixbuf/io-jpeg.c
++++ b/gdk-pixbuf/io-jpeg.c
+@@ -389,6 +389,8 @@ out:
+         if (!ret) {
+                 g_free (context->icc_profile);
+                 context->icc_profile = NULL;
++                context->icc_profile_size = 0;
++                context->icc_profile_size_allocated = 0;
+         }
+ 	return ret;
+ }
+-- 
+GitLab
+

diff --git a/gdk-pixbuf2.spec b/gdk-pixbuf2.spec
index 3ee9cc4..0fe69fe 100644
--- a/gdk-pixbuf2.spec
+++ b/gdk-pixbuf2.spec
@@ -16,6 +16,7 @@ URL:            https://gitlab.gnome.org/GNOME/gdk-pixbuf
 Source0:        https://download.gnome.org/sources/gdk-pixbuf/%{gnome_major_minor_version}/gdk-pixbuf-%{version}.tar.xz
 
 Patch0:         CVE-2026-16768.patch
+Patch1:         CVE-2026-81893.patch
 
 BuildRequires:  docbook-style-xsl
 BuildRequires:  gettext