public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed
From: Sandro Mani <manisandro@gmail.com>
To: git-commits@fedoraproject.org
Subject: [rpms/mingw-gdk-pixbuf] f44: Apply patches for CVE-2026-16768 and CVE-2026-81893
Date: Wed, 16 Sep 2026 07:09:32 GMT [thread overview]
Message-ID: <178954257209.1.9188808610849072798.rpms-mingw-gdk-pixbuf-06e5ede59d21@fedoraproject.org> (raw)
A new commit has been pushed.
Repo : rpms/mingw-gdk-pixbuf
Branch : f44
Commit : 06e5ede59d218ebb195e5e6b50b199d94b2f02d1
Author : Sandro Mani <manisandro@gmail.com>
Date : 2026-09-16T09:08:18+02:00
Stats : +101/-1 in 3 file(s)
URL : https://src.fedoraproject.org/rpms/mingw-gdk-pixbuf/c/06e5ede59d218ebb195e5e6b50b199d94b2f02d1?branch=f44
Log:
Apply patches for CVE-2026-16768 and CVE-2026-81893
---
diff --git a/279.patch b/279.patch
new file mode 100644
index 0000000..8bac6e4
--- /dev/null
+++ b/279.patch
@@ -0,0 +1,80 @@
+diff -rupN --no-dereference gdk-pixbuf-2.44.8/gdk-pixbuf/io-ico.c gdk-pixbuf-2.44.8-new/gdk-pixbuf/io-ico.c
+--- gdk-pixbuf-2.44.8/gdk-pixbuf/io-ico.c 2026-08-12 15:16:57.000000000 +0200
++++ gdk-pixbuf-2.44.8-new/gdk-pixbuf/io-ico.c 2026-09-16 09:07:36.437862436 +0200
+@@ -725,6 +725,7 @@ static void OneLine8(struct ico_progress
+ gint X;
+ guchar *Pixels;
+ gsize rowstride = gdk_pixbuf_get_rowstride (context->pixbuf);
++ gint palette_size = (context->HeaderSize - INFOHEADER_SIZE - context->DIBoffset) / 4;
+
+ X = 0;
+ if (context->Header.Negative == 0)
+@@ -734,13 +735,17 @@ static void OneLine8(struct ico_progress
+ Pixels = (gdk_pixbuf_get_pixels (context->pixbuf) +
+ rowstride * context->Lines);
+ while (X < context->Header.width) {
++ guint8 idx = context->LineBuf[X];
++ if (idx >= palette_size)
++ idx = 0;
++
+ /* The joys of having a BGR byteorder */
+ Pixels[X * 4 + 0] =
+- context->HeaderBuf[4 * context->LineBuf[X] + INFOHEADER_SIZE + 2 + context->DIBoffset];
++ context->HeaderBuf[4 * idx + INFOHEADER_SIZE + 2 + context->DIBoffset];
+ Pixels[X * 4 + 1] =
+- context->HeaderBuf[4 * context->LineBuf[X] + INFOHEADER_SIZE + 1 +context->DIBoffset];
++ context->HeaderBuf[4 * idx + INFOHEADER_SIZE + 1 +context->DIBoffset];
+ Pixels[X * 4 + 2] =
+- context->HeaderBuf[4 * context->LineBuf[X] + INFOHEADER_SIZE +context->DIBoffset];
++ context->HeaderBuf[4 * idx + INFOHEADER_SIZE +context->DIBoffset];
+ Pixels[X * 4 + 3] = 0xff;
+ X++;
+ }
+@@ -750,6 +755,7 @@ static void OneLine4(struct ico_progress
+ gint X;
+ guchar *Pixels;
+ gsize rowstride = gdk_pixbuf_get_rowstride (context->pixbuf);
++ gint palette_size = (context->HeaderSize - INFOHEADER_SIZE - context->DIBoffset) / 4;
+
+ X = 0;
+ if (context->Header.Negative == 0)
+@@ -761,25 +767,32 @@ static void OneLine4(struct ico_progress
+
+ while (X < context->Header.width) {
+ guchar Pix;
++ guint8 idx;
+
+ Pix = context->LineBuf[X/2];
++ idx = Pix >> 4;
++ if (idx >= palette_size)
++ idx = 0;
+
+ Pixels[X * 4 + 0] =
+- context->HeaderBuf[4 * (Pix>>4) + INFOHEADER_SIZE + 2 + context->DIBoffset];
++ context->HeaderBuf[4 * idx + INFOHEADER_SIZE + 2 + context->DIBoffset];
+ Pixels[X * 4 + 1] =
+- context->HeaderBuf[4 * (Pix>>4) + INFOHEADER_SIZE + 1 +context->DIBoffset];
++ context->HeaderBuf[4 * idx + INFOHEADER_SIZE + 1 +context->DIBoffset];
+ Pixels[X * 4 + 2] =
+- context->HeaderBuf[4 * (Pix>>4) + INFOHEADER_SIZE + context->DIBoffset];
++ context->HeaderBuf[4 * idx + INFOHEADER_SIZE + context->DIBoffset];
+ Pixels[X * 4 + 3] = 0xff;
+ X++;
+- if (X<context->Header.width) {
++ if (X<context->Header.width) {
+ /* Handle the other 4 bit pixel only when there is one */
++ idx = Pix & 15;
++ if (idx >= palette_size)
++ idx = 0;
+ Pixels[X * 4 + 0] =
+- context->HeaderBuf[4 * (Pix&15) + INFOHEADER_SIZE + 2 + context->DIBoffset];
++ context->HeaderBuf[4 * idx + INFOHEADER_SIZE + 2 + context->DIBoffset];
+ Pixels[X * 4 + 1] =
+- context->HeaderBuf[4 * (Pix&15) + INFOHEADER_SIZE + 1 + context->DIBoffset];
++ context->HeaderBuf[4 * idx + INFOHEADER_SIZE + 1 + context->DIBoffset];
+ Pixels[X * 4 + 2] =
+- context->HeaderBuf[4 * (Pix&15) + INFOHEADER_SIZE + context->DIBoffset];
++ context->HeaderBuf[4 * idx + INFOHEADER_SIZE + context->DIBoffset];
+ Pixels[X * 4 + 3] = 0xff;
+ X++;
+ }
diff --git a/efe658674bd103d1c9bf50809d5767a3f6dd5a01.patch b/efe658674bd103d1c9bf50809d5767a3f6dd5a01.patch
new file mode 100644
index 0000000..81f0be5
--- /dev/null
+++ b/efe658674bd103d1c9bf50809d5767a3f6dd5a01.patch
@@ -0,0 +1,12 @@
+diff -rupN --no-dereference gdk-pixbuf-2.44.8/gdk-pixbuf/io-jpeg.c gdk-pixbuf-2.44.8-new/gdk-pixbuf/io-jpeg.c
+--- gdk-pixbuf-2.44.8/gdk-pixbuf/io-jpeg.c 2026-08-12 15:16:57.000000000 +0200
++++ gdk-pixbuf-2.44.8-new/gdk-pixbuf/io-jpeg.c 2026-09-16 09:07:36.555813452 +0200
+@@ -389,6 +389,8 @@ out:
+ if (!ret) {
+ g_free (context->icc_profile);
+ context->icc_profile = NULL;
++ context->icc_profile_size = 0;
++ context->icc_profile_size_allocated = 0;
+ }
+ return ret;
+ }
diff --git a/mingw-gdk-pixbuf.spec b/mingw-gdk-pixbuf.spec
index b5a3adf..7665bb1 100644
--- a/mingw-gdk-pixbuf.spec
+++ b/mingw-gdk-pixbuf.spec
@@ -5,7 +5,7 @@
Name: mingw-gdk-pixbuf
Version: 2.44.8
-Release: 1%{?dist}
+Release: 2%{?dist}
Summary: MinGW Windows GDK Pixbuf library
License: LGPL-2.0-or-later
@@ -16,6 +16,11 @@ Source0: http://download.gnome.org/sources/gdk-pixbuf/%{release_version}/
# wine /usr/i686-w64-mingw32/sys-root/mingw/bin/gdk-pixbuf-query-loaders.exe | sed s@'Z:/usr/i686-w64-mingw32/sys-root/mingw'@'..'@ > gdk-pixbuf.loaders
Source1: gdk-pixbuf.loaders
+# Apply proposed fixed for CVE-2026-16768
+Patch0: https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/merge_requests/279.patch
+# Backport fix for CVE-2026-81893
+Patch1: https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/commit/efe658674bd103d1c9bf50809d5767a3f6dd5a01.patch
+
BuildArch: noarch
BuildRequires: mingw32-filesystem
@@ -140,6 +145,9 @@ install -m 0644 %{SOURCE1} %{buildroot}%{mingw64_libdir}/gdk-pixbuf-2.0/2.10.0/l
%changelog
+* Wed Sep 16 2026 Sandro Mani <manisandro@gmail.com> - 2.44.8-2
+- Apply patches for CVE-2026-16768 and CVE-2026-81893
+
* Fri Aug 21 2026 Sandro Mani <manisandro@gmail.com> - 2.44.8-1
- Update to 2.44.8
reply other threads:[~2026-09-16 7:09 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=178954257209.1.9188808610849072798.rpms-mingw-gdk-pixbuf-06e5ede59d21@fedoraproject.org \
--to=manisandro@gmail.com \
--cc=git-commits@fedoraproject.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox