[gimp/gimp-2-10] Issue #2685 - Crash when distributing layers horizontally

[Michael Natterer <mitch src gnome org>]

commit 4572da549188fe9021eeb1a7f28aeeeb0b14dc0e
Author: Michael Natterer <mitch gimp org>
Date:   Thu Jan 3 15:02:55 2019 +0100

    Issue #2685 - Crash when distributing layers horizontally
    
    Fix xcf-load.c to correct out-of-range item offsets (simply set them
    to 0), so XCF files that are broken this way can still be recovered.
    
    This doesn't fix the original bug, just recovering the crash images.
    
    (cherry picked from commit b9265e7cde21cd6416dd18f338b87a7a66e21006)

 app/xcf/xcf-load.c | 24 ++++++++++++++++++++----
 1 file changed, 20 insertions(+), 4 deletions(-)
---
diff --git a/app/xcf/xcf-load.c b/app/xcf/xcf-load.c
index 29ff1c1c2e..0aeb601c01 100644
--- a/app/xcf/xcf-load.c
+++ b/app/xcf/xcf-load.c
@@ -1174,11 +1174,27 @@ xcf_load_layer_props (XcfInfo    *info,
 
         case PROP_OFFSETS:
           {
-            guint32 offset_x;
-            guint32 offset_y;
+            gint32 offset_x;
+            gint32 offset_y;
 
-            xcf_read_int32 (info, &offset_x, 1);
-            xcf_read_int32 (info, &offset_y, 1);
+            xcf_read_int32 (info, (guint32 *) &offset_x, 1);
+            xcf_read_int32 (info, (guint32 *) &offset_y, 1);
+
+            if (offset_x < -GIMP_MAX_IMAGE_SIZE ||
+                offset_x > GIMP_MAX_IMAGE_SIZE)
+              {
+                g_printerr ("unexpected item offset_x (%d) in XCF, "
+                            "setting to 0\n", offset_x);
+                offset_x = 0;
+              }
+
+            if (offset_y < -GIMP_MAX_IMAGE_SIZE ||
+                offset_y > GIMP_MAX_IMAGE_SIZE)
+              {
+                g_printerr ("unexpected item offset_y (%d) in XCF, "
+                            "setting to 0\n", offset_y);
+                offset_y = 0;
+              }
 
             gimp_item_set_offset (GIMP_ITEM (*layer), offset_x, offset_y);
           }