this is the image that I converted to xpm with gimp
http://www.lns.cornell.edu/~seb/celestia/carina-earth.jpg

Is this a regression (and hence due to the xpm security fixes)?

Running XFree86-4.1.0-62.EL I see the same behavior as
XFree86-4.1.0-64.EL.  Thus, it *may* be reasonable to assume that the
security fix did not cause the problem?

I see the same behavior on i386 and ia64... both of which are very
powerful systems.

Tried with a smaller jpg at bressers' suggestion and did not see any
problems with XFree86-4.1.0-62.EL with XFree86-4.1.0-64.E. Thus this
does not appear to be a regression, but instead a problem with
converting certain files to xpm.

X does not convert JPGs to xpm or vice versa.  Reassign the bug
to the application you are using.  I suspect it is a performance
or optimization issue in that specific application, and probably
has nothing to do with X.

People, XPM is not known as the most efficient image format on the planet for a
reason. It's not designed for large, photorealistic imagery but for small icons
and stuff with few colors (some people would say it isn't designed at all). It's
indexed, uncompressed and wrapped up in C syntax. Let's see how your image looks
in XPM format (abridged):

--- 8< ---
/* XPM */
static char * carina_earth_xpm[] = { 
"1600 1200 125796 3", 
"       c #C57250", 
".      c #C76D4B", 
"+      c #D16549", 
"@      c #CE644A", 
"#      c #C16B52",
[...]
" .     c #AF7F57",
"..     c #B3835B",
"+.     c #B4845C",
"@.     c #B2825A",
"#.     c #B8875F",
[...]
"  .    c #B85864",
". .    c #C16A7A",
"+ .    c #C2697B",
"@ .    c #C45A6E",
"# .    c #A53949",
[...]
"   .  +  @  #  $  %  &  *  =  -  ;  >  ,  '  )  !  ~  {  {  ]  ]  ^  ^  /  (  _
 :  <  [  [  }  |  1  2  3  4  5  6  7  8  9  0  a  b  c  d  e  f  g  h  i  j  k
 l  m  n  o  p  q  r  s  t  u  v  w  x  y  z  A  B  C  D  E  F  G  H  I  J  K  L
 M  N  O  P  Q  R  S  T  U  V  W  X  Y  Z  `  V   . .. +. @. .. #. $. %. &. *.
=. -. *. ;. >. ,. '. ). ). !. ~. {. ]. ^. /. (. _. :. :. <. :. [. }. |. 1. 2. 3.
4. 5. 6. 6. 7. 8. 9. 0. a. b. c. d. e. e. f. g. h. h. i. i. j. k. l. m. n. o. M
 p. q. r. s. t. u. v. w. x. y. z. A. B. C. D. E. F. G. H. H. H. I. I. T  I. J.
K. L. L. M. N. O. P. Q. R. S. T. U. V. W. X. Y. Z. `.  + .+ .+ ++ ++ @+ #+ $+ %+
&+ *+ =+ -+ ;+ ;+ >+ ,+ >+ '+ )+ !+ ~+ {+ ]+ ^+ K. /+ (+ _+ :+ <+ [+ }+ |+ 1+ 2+
3+ 3+ 3+ 4+ 4+ 5+ 5+ 6+ 7+ 8+ 9+ 0+ 0+ 9+ a+ b+ c+ d+ e+ f+ g+ h+ i+ j+ j+ k+ l+
m+ n+ n+ o+ p+ q+ r+ s+ t+ u+ u+ u+ s+ r+ p+ p+ q+ q+ p+ v+ p+ p+ q+ r+ s+ w+ x+
y+ u+ w+ z+ x+ x+ w+ u+ t+ A+ A+ A+ B+ C+ m+ D+ E+ F+ G+ H+ I+ H+ H+ I+ J+ K+ L+
M+ N+ O+ P+ Q+ R+ S+ T+ U+ V+ W+ W+ X+ Y+ Z+ `+  @ .@ +@ @@ #@ #@ $@ %@ &@ *@ =@
-@ ;@ >@ ,@ '@ )@ !@ ~@ {@ ]@ ^@ /@ (@ _@ _@ :@ :@ <@ [@ }@ |@ 1@ 2@ 3@ 4@ 5@ 6@
7@ 8@ 9@ 0@ a@ a@ b@ a@ c@ d@ e@ e@ d@ d@ f@ g@ h@ i@ j@ i@ k@ k@ l@ m@ n@ o@ o@
p@ q@ r@ q@ s@ t@ u@ v@ 9@ w@ w@ 9@ 0@ x@ y@ z@ A@ z@ z@ A@ B@ A@ A@ A@ z@ y@ x@
x@ C@ D@ D@ D@ D@ v@ 9@ E@ F@ 5@ 5@ G@ H@ H@ H@ G@ I@ J@ K@ L@ K@ M@ M@ 6@ N@ O@
P@ Q@ R@ S@ Q@ T@ U@ V@ W@ X@ Y@ Y@ Z@ `@  # .# +#  #  #  #  # @# ## $# %# &# &#
*# *# =# =# -# ;# ># ,# ># ># '# )# ;# !# ~# ~# {# ]# ^# ^# /# /# (# (# (# (# _#
_# :# <# [# }# <# <# |# 1# 2# 3# 4# [# 5# <# /# 6# 7# 8# $# 9# 0# 0# 0# 0# a# a#
b# b# b# b# b# b# c# c# a# d# e# f# e# g# h# i# i# j# j# j# i# i# g# g# k# k# l#
l# m# n# o# p# q# r# L@ K@ K@ K@ s# t# L@ K@ u# u# u# u# M@ v# L@ t# L@ v# w# x#
y# z# A# A# B# C# D# E# F# G# H# I# J# J# K# L# M# N# O# P# Q# N# R# S# T# U# P#
P# O# S# T# V# W# X# Y# Z# `#  $ .$ +$ @$ @$ #$ #$ #$ $$ %$ &$ *$ =$ -$ ;$ >$ ,$
'$ '$ )$ !$ ~$ {$ ]$ ^$ /$ ($ _$ :$ <$ [$ }$ |$ 1$ 2$ 3$ 4$ 5$ 5$ 6$ 7$ 8$ 9$ 0$
a$ b$ c$ d$ e$ f$ g$ 8$ h$ i$ j$ k$ l$ m$ n$ o$ p$ q$ r$ s$ t$ u$ u$ v$ w$ x$ y$
z$ A$ B$ C$ D$ E$ F$ G$ F$ H$ H$ I$ H$ I$ G$ J$ K$ L$ M$ M$ N$ N$ N$ O$ P$ Q$ R$
S$ T$ U$ V$ W$ X$ X$ Y$ Y$ Z$ `$  % .% +% +% @% #% $% %% &% &% *% =% -% ;% >% ,%
'% ,% )% !% )% ~% {% {% ]% ]% ]% ]% ]% ]% ^% /% (% _% ^% :% <% [% }% |% |% |% 1%
1% 2% 2% #% #% 3% 3% 4% 5% 6% 7% 8% 9% 9% 0% a% b% b% c% d% e% f% g% h% i% j% j%
k% <% l% l% m% n% o% p% n% l% q% r% r% q% s% k% s% J  t% u% v% v% w% x% y% z% A%
B% y% C% D% E% F% F% G% G% G% G% x+ x+ H% I% I% J% J% K% K% K% K% L% M% N% N% M%
O% L% u+ w+ x+ y+ P% Q% R% S% T% U% U% V% W% X% X% Y% Z% `% `% `% `% `% Z% Z%  &
Z% .& +& @& #& @& $& %& && *& =& -& -& ;& ;& >& ,& '& )& !& !& ~& ~& {& ]& ^& ^&
^& /& (& _& :& <& [& }& |& 1& 2& 1& 3& 4& 5& 6& 5& 5& 7& 8& 7& 7& 7& 7& 7& 7& 7&
7& 6& 9& 0& 0& a& b& c& d& e& f& g& h& i& j& j& k& l& m& n& o& p& p& p& q& q& o&
n& r& r& n& q& p& s& t& u& v& w& x& y& y& z& A& B& C& D& E& F& G& H& I& J& K& L&
M& N& N& O& P& Q& R& S& T& S& U& V& W& X& Y& Z& `&  *  * .* +* @* #* #* @* $* %*
&* ** =* =* -* ;* >* ,* '* )* !* ~* {* ]* ^* /* (* _* :* <* [* }* |* 1* 2* 2* 3*
4* 5* 5* 6* 4* 7* 8* 9* 0* a* b* c* d* e* f* g* h* i* j* k* l* m* n* o* p* q* r*
s* 7* 7* t* u* u* v* w* x* y* z* A* B* C* D* h* E* F* E* |* G* E* H* C* F* I* J*
K* L* M* N* O* P* Q* R* S* T* U* U* V* W* X* Y* <* Z* Z* `*  = .= += &* @= #= $=
%= %= &= *= == -= ;= >= ,= '= )= != ~= -= ;= ~= {= ~= ,= ]= ^= /= (= _= := <= [=
}= |= 1= 2= 3= 4= 5= 6= 7= 8= 9= 0= a= b= c= d= d= e= f= g= h= i= i= j= k= l= m=
n= o= p= q= r= s= t= u= v= v= w= x= x= y= z= A= B= C= D= E= F= G= H= I= J= K= L=
M= N= O= P= Q= R= S= T= U= V= V= W= X= Y= Z= `=  - .- .- +- @- #- $- %- &- *- *-
#- =- -- ;- >- ,- >- '- <* o* )- !- ~- {- ]- ^- /- (- _- :- <- [- }- |- 1- 2- 3-
4- 5- 5- 6- 6- 7- a= 8- 9- 0- a- b- c- d- e- f- g- h- i- j- k- l- k- m- n- o- p-
q- r- s- t- u- v- w- x- y- z- A- m* B- C- D- E- F- G- H- I- J- J- K- L- M- N- O-
P- Q- Q- R- R- S- T- U- V- W- X- Y- Z- `-  ; .; +; @; #; $; %; &; *; =; -; ;; ;;
>; -; >; ;; ;; ,; ;; >; '; ); !; ~; {; ]; ^; /; /; /; (; ^; _; :; (; ^; /; :; <;
[; }; |; 1; 2; 3; 4; 5; 6; 7; 8; 9; 0; a; b; c; c; d; e; f; f; g; h; i; j; k; l;
m; n; o; p; q; r; s; t; u; v; w; x; y; z; A; B; C; D; E; F; G; H; I; J; K; L; M;
N; O; P; Q; R; S; T; U; V; W; X; Y; Z; `;  > .> +> @> #> $> %> &> &> *> => -> ;>
>> ,> '> )> !> ~> {> ]> ^> /> (> _> :> <> [> }> |> 1> 2> 3> 4> 5> 6> 7> 8> 9> 0>
a> b> c> d> e> f> g> h> i> j> k> l> m> n> o> p> q> r> s> t> e> u> v> w> x> y> z>
A> B> C> D> E> F> G> H> I> J> K> L> M> K> N> O> P> Q> R> S> T> U> x> U> V> W> X>
Y> Z> `>  , ., 3> +, @, #, $, %, &, *, =, -, ;, >, ,, ', ), ', !, ~, {, ], ^, /,
(, _, :, <, [, }, |, S> |, }, [, 1, 2, 2, 2, 3, X; 4, 4, 5, 6, 7, 8, 9, 0, a, a,
a, a, 0, b, c, d, 6, 6, 6, ",
[...]
--- >8 ---

So you've got a C syntax string array that needs to be parsed up -- securely
mind that, you don't know where the image came from -- where you don't know
right away how many characters (1, 2 or 3) represent one pixel. Taking into
account the dimensions of the image and the number of colors used (over 120000)
it doesn't surprise me at all that it takes a long time to load, the algorithm
also isn't parallelized, so you could have 512 CPUs and it wouldn't make a
difference. Trying to load the image and stracing the xpm plugin showed that it
takes very long (a second or more) to load one line of the file...

You could argue that there were room for optimization and there probably is, but
as you're using the tool XPM for a job way outside its specification envelope, I
doubt that it's worth the effort. I'm closing this UPSTREAM so if you can
convince the upstream developers to optimize this case and they come up with a
patch or you come up with one by yourself, I'd be happy to include it (though
that'd have to be against gimp-2.2pre, not gimp-1.x).