[gimp/gimp-2-10] plug-ins: improve error handling when loading g3 fax images.

[Jacob Boerema <jboerema src gnome org>]

commit fb38e42ff459f18ec709d4c39def8ee42ebd026d
Author: Jacob Boerema <jgboerema gmail com>
Date:   Fri Mar 5 14:03:48 2021 -0500

    plug-ins: improve error handling when loading g3 fax images.
    
    Fixes issue #475 Loading a fuzzed .g3 file fails.
    
    (cherry picked from commit 1edd11483454256ba4dcb5412e3962c0f0f6feb2)
    
    # Conflicts:
    #       plug-ins/file-faxg3/faxg3.c

 plug-ins/file-faxg3/faxg3.c | 38 +++++++++++++++++++++++++++++++++++---
 1 file changed, 35 insertions(+), 3 deletions(-)
---
diff --git a/plug-ins/file-faxg3/faxg3.c b/plug-ins/file-faxg3/faxg3.c
index 17a45e9c2f..d219697c0b 100644
--- a/plug-ins/file-faxg3/faxg3.c
+++ b/plug-ins/file-faxg3/faxg3.c
@@ -68,7 +68,8 @@ static gint32 emitgimp   (gint              hcol,
                           gint              row,
                           const gchar      *bitmap,
                           gint              bperrow,
-                          const gchar      *filename);
+                          const gchar      *filename,
+                          GError          **error);
 
 
 const GimpPlugInInfo PLUG_IN_INFO =
@@ -266,6 +267,12 @@ load_image (const gchar  *filename,
   row = col = hcol = 0;
 
   bitmap = g_new0 (gchar, (max_rows = MAX_ROWS) * MAX_COLS / 8);
+  if (! bitmap)
+    {
+      g_set_error (error, G_FILE_ERROR, G_FILE_ERROR_FAILED,
+                   _("Could not create buffer to process image data."));
+      return NULL;
+    }
 
   bp = &bitmap[row * MAX_COLS / 8];
 
@@ -482,7 +489,7 @@ load_image (const gchar  *filename,
   g_printerr ("consecutive EOLs: %d, max columns: %d\n", cons_eol, hcol);
 #endif
 
-  image_id = emitgimp (hcol, row, bitmap, bperrow, filename);
+  image_id = emitgimp (hcol, row, bitmap, bperrow, filename, error);
 
   g_free (bitmap);
 
@@ -500,7 +507,8 @@ emitgimp (gint         hcol,
           gint         row,
           const gchar *bitmap,
           gint         bperrow,
-          const gchar *filename)
+          const gchar *filename,
+          GError     **error)
 {
   GeglBuffer *buffer;
   gint32      image_ID;
@@ -519,7 +527,23 @@ emitgimp (gint         hcol,
   g_printerr ("emit gimp: %d x %d\n", hcol, row);
 #endif
 
+  if (hcol > GIMP_MAX_IMAGE_SIZE || hcol <= 0 ||
+      row > GIMP_MAX_IMAGE_SIZE || row <= 0)
+    {
+      g_set_error (error, G_FILE_ERROR, G_FILE_ERROR_FAILED,
+                   _("Invalid image dimensions (%d x %d). "
+                     "Image may be corrupt."),
+                   hcol, row);
+      return NULL;
+    }
+
   image_ID = gimp_image_new (hcol, row, GIMP_GRAY);
+  if (image_ID == -1)
+    {
+      g_set_error (error, G_FILE_ERROR, G_FILE_ERROR_FAILED,
+                   _("Could not create image."));
+      return NULL;
+    }
   gimp_image_set_filename (image_ID, filename);
 
   layer_ID = gimp_layer_new (image_ID, _("Background"),
@@ -538,6 +562,14 @@ emitgimp (gint         hcol,
 #endif
 
   buf = g_new (guchar, hcol * tile_height);
+  if (! buf)
+    {
+      g_set_error (error, G_FILE_ERROR, G_FILE_ERROR_FAILED,
+                   _("Could not create buffer to process image data."));
+      g_object_unref (buffer);
+      gimp_image_delete(image);
+      return NULL;
+    }
 
   xx = 0;
   yy = 0;