Re: [meta-lts-collab][kirkstone][PATCH] jpeg: Reject unsupported number of components

Hi team,
Please ignore the patch. Will update patch commit message and send it again

Regards,
Jackson James

On Tue, 23 Jun, 2026, 3:18 pm Jackson James, <[email protected]>
wrote:

> From: Shaik Moin <[email protected]>
>
> This condition was already checked for incremental loading.
> This commit adds the same check in the nonincremental
> code path.
>
> Signed-off-by: Shaik Moin <[email protected]>
> ---
>  .../gdk-pixbuf/gdk-pixbuf/CVE-2026-5201.patch | 47 +++++++++++++++++++
>  .../gdk-pixbuf/gdk-pixbuf_%.bbappend          |  4 ++
>  2 files changed, 51 insertions(+)
>  create mode 100644
> meta-oe/recipes-gnome/gdk-pixbuf/gdk-pixbuf/CVE-2026-5201.patch
>  create mode 100644 meta-oe/recipes-gnome/gdk-pixbuf/gdk-pixbuf_%.bbappend
>
> diff --git
> a/meta-oe/recipes-gnome/gdk-pixbuf/gdk-pixbuf/CVE-2026-5201.patch
> b/meta-oe/recipes-gnome/gdk-pixbuf/gdk-pixbuf/CVE-2026-5201.patch
> new file mode 100644
> index 0000000..d5bf327
> --- /dev/null
> +++ b/meta-oe/recipes-gnome/gdk-pixbuf/gdk-pixbuf/CVE-2026-5201.patch
> @@ -0,0 +1,47 @@
> +From 4d6eb46037d1b6a298d5db293dba57bbea4d0d08 Mon Sep 17 00:00:00 2001
> +From: Shaik Moin <[email protected]>
> +Date: Thu, 18 Jun 2026 14:51:28 +0530
> +Subject: [PATCH] jpeg: Reject unsupported number of components
> +
> +Backport the fix for CVE-2026-5201
> +
> +This condition was already checked for incremental loading.
> +This commit adds the same check in the nonincremental
> +code path.
> +
> +CVE: CVE-2026-5201
> +
> +Upstream-Status: Backport [
> https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/commit/6cce9311e70b969cbcc6e3e1e74ae1756ed02d5b
> ]
> +
> +Reviewed-by: Matthias Clasen <[email protected]>
> +Signed-off-by: Shaik Moin <[email protected]>
> +---
> + gdk-pixbuf/io-jpeg.c | 12 ++++++++++++
> + 1 file changed, 12 insertions(+)
> +
> +diff --git a/gdk-pixbuf/io-jpeg.c b/gdk-pixbuf/io-jpeg.c
> +index 9ee1d21..60ad0d0 100644
> +--- a/gdk-pixbuf/io-jpeg.c
> ++++ b/gdk-pixbuf/io-jpeg.c
> +@@ -625,6 +625,18 @@ gdk_pixbuf__real_jpeg_image_load (FILE *f, struct
> jpeg_decompress_struct *cinfo,
> +       cinfo->do_fancy_upsampling = FALSE;
> +       cinfo->do_block_smoothing = FALSE;
> +
> ++        /* Reject unsupported component counts */
> ++        if (cinfo->output_components != 3 && cinfo->output_components !=
> 4 &&
> ++            !(cinfo->output_components == 1 &&
> ++              cinfo->out_color_space == JCS_GRAYSCALE)) {
> ++                g_set_error (error,
> ++                             GDK_PIXBUF_ERROR,
> ++                             GDK_PIXBUF_ERROR_CORRUPT_IMAGE,
> ++                             _("Unsupported number of color components
> (%d)"),
> ++                             cinfo->output_components);
> ++                goto out;
> ++        }
> ++
> +       pixbuf = gdk_pixbuf_new (GDK_COLORSPACE_RGB,
> +                                cinfo->out_color_components == 4 ? TRUE :
> FALSE,
> +                                8,
> +--
> +2.34.1
> +
> diff --git a/meta-oe/recipes-gnome/gdk-pixbuf/gdk-pixbuf_%.bbappend
> b/meta-oe/recipes-gnome/gdk-pixbuf/gdk-pixbuf_%.bbappend
> new file mode 100644
> index 0000000..6a5584e
> --- /dev/null
> +++ b/meta-oe/recipes-gnome/gdk-pixbuf/gdk-pixbuf_%.bbappend
> @@ -0,0 +1,4 @@
> +FILESEXTRAPATHS:prepend := "${THISDIR}/files:"
> +
> +SRC_URI += "file://CVE-2026-5201.patch \
> +"
> --
> 2.34.1
>
>