Commit b3de0bb7 authored by Jehan's avatar Jehan

Issue #1731: gbr file that crashes gimp-2.10.

GIMP_BRUSH_MAX_SIZE was already defined (as 10.000 pixels per dimension,
which is big for a brush) in gimpbrush.h. Let's just use this to
validate the size returned by the header.
parent 19f4abbb
......@@ -34,7 +34,6 @@
#include "gimp-intl.h"
/* stuff from abr2gbr Copyright (C) 2001 Marco Lamberto <lm@sunnyspot.org> */
/* the above is GPL see http://the.sunnyspot.org/gimp/ */
......@@ -189,6 +188,15 @@ gimp_brush_load_brush (GimpContext *context,
return NULL;
}
if (header.width > GIMP_BRUSH_MAX_SIZE ||
header.height > GIMP_BRUSH_MAX_SIZE)
{
g_set_error (error, GIMP_DATA_ERROR, GIMP_DATA_ERROR_READ,
_("Fatal parse error in brush file: %dx%d over max size."),
header.width, header.height);
return NULL;
}
switch (header.version)
{
case 1:
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment