Gimp: gimp integer overflow

An attacker crafts an image with very large dimensions (e.g., 70,000 x 70,000 pixels) and convinces the victim to open it in GIMP and apply the Despeckle filter [ref_id=1]. The despeckle function multiplies width * height * img_bpp without overflow checking; when the product exceeds the bounds of gsize, the result wraps around to a small value [ref_id=1]. The subsequent g_new() call allocates insufficient memory, and the pixel-processing loops then write beyond the allocated src and dst buffers, causing heap corruption [ref_id=1].

The vulnerable code is in the despeckle function within the file despeckle.c [ref_id=1]. The width and height values are retrieved from gimp_drawable_mask_intersect() and img_bpp is determined via babl_format_get_bytes_per_pixel() (commonly 1 to 4) [ref_id=1]. The multiplication width * height * img_bpp is performed without overflow checking before being passed to g_new() [ref_id=1].

The issue report recommends using overflow-safe arithmetic (e.g., g_size_checked_mul or similar) to compute the allocation size before calling g_new() [ref_id=1]. No patch is included in the bundle, so the exact committed fix is not shown; however, the remediation is to validate that width * height * img_bpp does not overflow gsize before performing the allocation, preventing undersized buffer creation and subsequent out-of-bounds writes [ref_id=1].