Commit 4d4a8cf7 authored by Massimo Valentini's avatar Massimo Valentini Committed by Jehan

Bug 789610: invalid gbr brush crashing GIMP

(cherry picked from commit 657a754f)
parent 08bda40e
......@@ -161,7 +161,7 @@ gimp_brush_load_brush (GimpContext *context,
GError **error)
{
GimpBrush *brush;
gint bn_size;
gsize bn_size;
BrushHeader header;
gchar *name = NULL;
guchar *pixmap;
......@@ -260,6 +260,12 @@ gimp_brush_load_brush (GimpContext *context,
return NULL;
}
if (header.header_size < sizeof (BrushHeader))
{
g_message (_("Unsupported brush format"));
return NULL;
}
/* Read in the brush name */
if ((bn_size = (header.header_size - sizeof (header))))
{
......
......@@ -413,6 +413,12 @@ load_image (const gchar *filename,
/* And we need to rewind the handle, 4 due spacing and 4 due magic */
lseek (fd, -8, SEEK_CUR);
bh.header_size += 8;
if (bh.header_size < sizeof (BrushHeader))
{
g_message (_("Unsupported brush format"));
g_object_unref (input);
return -1;
}
break;
case 3: /* cinepaint brush */
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment