CWE-807, CWE-20

Hi Team,

https://github.com/GNOME/gimp/blob/master/app/tests/test-xcf.c#L314

i.e

filename = g_build_filename (g_get_tmp_dir (), "gimp-test.xcf", NULL);

This function is synonymous with 'getenv("TMP")';it returns untrustable input if the environment can beset by an attacker. It can have any content and length, and the same variable can be set more than once.

Check environment variables carefully before using them.

Request team to please have a look and validate.

Cheers, Dhiraj