Bug 2539562

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

An out-of-bounds heap write flaw was found in GIMP's PVR image loader. The pvr_decode_twiddle() function checks that its source offset remains within the attacker-supplied file data, but it does not check that the destination offset remains within the allocated pixel buffer. For non-square textures whose height is not a multiple of the width, the traversal advances beyond the correctly sized destination buffer and writes file-derived pixel data out of bounds. An attacker can control the texture dimensions, overflow length, heap allocation size class, and the values written from the PVR file. Opening a crafted PVR image can therefore corrupt adjacent heap objects in the file-pvr plug-in process, potentially resulting in arbitrary code execution. The upstream report reproduced the issue with AddressSanitizer in GIMP 3.2.6 and found identical code in the main branch. Versions 3.2.0 and later are affected. This is distinct from GIMP issue 16326 because the allocation size does not wrap; the defect is the unchecked destination traversal. A patch was available, but no fixed release had been identified at the time of reporting.