--- /dev/null Thu Jan 01 00:00:00 1970 +0000
+++ b/patches/gimp-06-CVE-2010-454x.diff Tue Sep 13 12:17:59 2011 +0000
@@ -0,0 +1,116 @@
+--- gimp-2.6.10.orig/plug-ins/common/sphere-designer.c 2011-08-16 11:48:50.451538000 +0530
++++ gimp-2.6.10/plug-ins/common/sphere-designer.c 2011-08-16 11:53:08.714956000 +0530
+@@ -1992,6 +1992,7 @@ loadit (const gchar * fn)
+ gchar endbuf[21 * (G_ASCII_DTOSTR_BUF_SIZE + 1)];
+ gchar *end = endbuf;
+ gchar line[1024];
++ gchar fmt_str[16];
+ gint i;
+ texture *t;
+ gint majtype, type;
+@@ -2016,6 +2017,8 @@ loadit (const gchar * fn)
+
+ s.com.numtexture = 0;
+
++ snprintf (fmt_str, sizeof (fmt_str), "%%d %%d %%%lds", sizeof (endbuf) - 1);
++
+ while (!feof (f))
+ {
+
+@@ -2026,7 +2029,7 @@ loadit (const gchar * fn)
+ t = &s.com.texture[i];
+ setdefaults (t);
+
+- if (sscanf (line, "%d %d %s", &t->majtype, &t->type, end) != 3)
++ if (sscanf (line, fmt_str, &t->majtype, &t->type, end) != 3)
+ t->color1.x = g_ascii_strtod (end, &end);
+ if (end && errno != ERANGE)
+ t->color1.y = g_ascii_strtod (end, &end);
+--- gimp-2.6.10.orig/plug-ins/gfig/gfig-style.c 2011-08-16 11:48:42.938675000 +0530
++++ gimp-2.6.10/plug-ins/gfig/gfig-style.c 2011-08-16 11:57:17.625677000 +0530
+@@ -165,6 +165,7 @@ gfig_read_parameter_gimp_rgb (gchar
+ gchar *ptr;
+ gchar *tmpstr;
+ gchar *endptr;
++ gchar fmt_str[32];
+ gchar colorstr_r[G_ASCII_DTOSTR_BUF_SIZE];
+ gchar colorstr_g[G_ASCII_DTOSTR_BUF_SIZE];
+ gchar colorstr_b[G_ASCII_DTOSTR_BUF_SIZE];
+@@ -172,6 +173,8 @@ gfig_read_parameter_gimp_rgb (gchar
+
+ style_entry->r = style_entry->g = style_entry->b = style_entry->a = 0.;
+
++ snprintf (fmt_str, sizeof (fmt_str), "%%%lds %%%lds %%%lds %%%lds", sizeof (colorstr_r) - 1, sizeof (colorstr_g) - 1, sizeof (colorstr_b) - 1, sizeof (colorstr_a) - 1);
++
+ while (n < nitems)
+ {
+ ptr = strchr (text[n], ':');
+@@ -181,7 +184,7 @@ gfig_read_parameter_gimp_rgb (gchar
+ ptr++;
+ if (!strcmp (tmpstr, name))
+ {
+- sscanf (ptr, "%s %s %s %s", colorstr_r, colorstr_g, colorstr_b, colorstr_a);
++ sscanf (ptr, fmt_str, colorstr_r, colorstr_g, colorstr_b, colorstr_a);
+ style_entry->r = g_ascii_strtod (colorstr_r, &endptr);
+ style_entry->g = g_ascii_strtod (colorstr_g, &endptr);
+ style_entry->b = g_ascii_strtod (colorstr_b, &endptr);
+--- gimp-2.6.10.orig/plug-ins/lighting/lighting-ui.c 2011-08-16 11:48:41.292829000 +0530
++++ gimp-2.6.10/plug-ins/lighting/lighting-ui.c 2011-08-16 12:14:35.185283000 +0530
+@@ -1342,6 +1342,7 @@ load_preset_response (GtkFileChooser *ch
+ gchar buffer3[G_ASCII_DTOSTR_BUF_SIZE];
+ gchar type_label[21];
+ gchar *endptr;
++ gchar fmt_str[32];
+
+ if (response_id == GTK_RESPONSE_OK)
+ {
+@@ -1381,23 +1382,27 @@ load_preset_response (GtkFileChooser *ch
+ return;
+ }
+
+- fscanf (fp, " Position: %s %s %s", buffer1, buffer2, buffer3);
++ snprintf (fmt_str, sizeof (fmt_str), " Position: %%%lds %%%lds %%%lds", sizeof (buffer1) - 1, sizeof (buffer2) - 1, sizeof (buffer3) - 1);
++ fscanf (fp, fmt_str, buffer1, buffer2, buffer3);
+ source->position.x = g_ascii_strtod (buffer1, &endptr);
+ source->position.y = g_ascii_strtod (buffer2, &endptr);
+ source->position.z = g_ascii_strtod (buffer3, &endptr);
+
+- fscanf (fp, " Direction: %s %s %s", buffer1, buffer2, buffer3);
++ snprintf (fmt_str, sizeof (fmt_str), " Direction: %%%lds %%%lds %%%lds", sizeof (buffer1) - 1, sizeof (buffer2) - 1, sizeof (buffer3) - 1);
++ fscanf (fp, fmt_str, buffer1, buffer2, buffer3);
+ source->direction.x = g_ascii_strtod (buffer1, &endptr);
+ source->direction.y = g_ascii_strtod (buffer2, &endptr);
+ source->direction.z = g_ascii_strtod (buffer3, &endptr);
+
+- fscanf (fp, " Color: %s %s %s", buffer1, buffer2, buffer3);
++ snprintf (fmt_str, sizeof (fmt_str), " Color: %%%lds %%%lds %%%lds", sizeof (buffer1) - 1, sizeof (buffer2) - 1, sizeof (buffer3) - 1);
++ fscanf (fp, fmt_str, buffer1, buffer2, buffer3);
+ source->color.r = g_ascii_strtod (buffer1, &endptr);
+ source->color.g = g_ascii_strtod (buffer2, &endptr);
+ source->color.b = g_ascii_strtod (buffer3, &endptr);
+ source->color.a = 1.0;
+
+- fscanf (fp, " Intensity: %s", buffer1);
++ snprintf (fmt_str, sizeof (fmt_str), " Intensity: %%%lds", sizeof (buffer1) - 1);
++ fscanf (fp, fmt_str, buffer1);
+ source->intensity = g_ascii_strtod (buffer1, &endptr);
+
+ }
+--- gimp-2.6.10.orig/plug-ins/common/file-psp.c 2011-08-16 11:48:49.945737000 +0530
++++ gimp-2.6.10/plug-ins/common/file-psp.c 2011-08-16 12:04:16.278205000 +0530
+@@ -1246,13 +1246,14 @@ read_channel_data (FILE *f,
+ fread (buf, runcount, 1, f);
+ if (bytespp == 1)
+ {
++ runcount = MIN (runcount, endq - q);
+ memmove (q, buf, runcount);
+ q += runcount;
+ }
+ else
+ {
+ p = buf;
+- for (i = 0; i < runcount; i++)
++ for (i = 0; i < runcount && q < endq; i++)
+ {
+ *q = *p++;
+ q += bytespp;