[gimp] Issue #2685 - Crash when distributing layers horizontally

[Michael Natterer <mitch src gnome org>]

commit b9265e7cde21cd6416dd18f338b87a7a66e21006
Author: Michael Natterer <mitch gimp org>
Date:   Thu Jan 3 15:02:55 2019 +0100

    Issue #2685 - Crash when distributing layers horizontally
    
    Fix xcf-load.c to correct out-of-range item offsets (simply set them
    to 0), so XCF files that are broken this way can still be recovered.
    
    This doesn't fix the original bug, just recovering the crash images.

 app/xcf/xcf-load.c | 24 ++++++++++++++++++++----
 1 file changed, 20 insertions(+), 4 deletions(-)
---
diff --git a/app/xcf/xcf-load.c b/app/xcf/xcf-load.c
index eb79f030b9..f7bd071fa3 100644
--- a/app/xcf/xcf-load.c
+++ b/app/xcf/xcf-load.c
@@ -1183,11 +1183,27 @@ xcf_load_layer_props (XcfInfo    *info,
 
         case PROP_OFFSETS:
           {
-            guint32 offset_x;
-            guint32 offset_y;
+            gint32 offset_x;
+            gint32 offset_y;
 
-            xcf_read_int32 (info, &offset_x, 1);
-            xcf_read_int32 (info, &offset_y, 1);
+            xcf_read_int32 (info, (guint32 *) &offset_x, 1);
+            xcf_read_int32 (info, (guint32 *) &offset_y, 1);
+
+            if (offset_x < -GIMP_MAX_IMAGE_SIZE ||
+                offset_x > GIMP_MAX_IMAGE_SIZE)
+              {
+                g_printerr ("unexpected item offset_x (%d) in XCF, "
+                            "setting to 0\n", offset_x);
+                offset_x = 0;
+              }
+
+            if (offset_y < -GIMP_MAX_IMAGE_SIZE ||
+                offset_y > GIMP_MAX_IMAGE_SIZE)
+              {
+                g_printerr ("unexpected item offset_y (%d) in XCF, "
+                            "setting to 0\n", offset_y);
+                offset_y = 0;
+              }
 
             gimp_item_set_offset (GIMP_ITEM (*layer), offset_x, offset_y);
           }