Bug 2533137

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

A heap-based buffer overflow flaw was found in GIMP's ICO file loader. When processing an ICO file containing an embedded PNG image, ico-load.c calculates the required buffer size using an unchecked 32-bit signed multiplication of the image's width and height. Specially crafted dimensions can overflow this calculation, causing an undersized buffer to be allocated, while libpng continues decoding the image using the original, unvalidated dimensions. This results in a heap-based buffer overflow when the decoded pixel data is written past the end of the allocated buffer. An attacker could exploit this by crafting a malicious ICO file that, when opened in GIMP, leads to a crash or arbitrary code execution in the context of the user running GIMP.