libgimpbase/gimpreloc.c | 3 3 + 0 - 0 !
1 file changed, 3 insertions(+)

 define path_max to fix build on the hurd.

plug-ins/common/qbist.c | 3 3 + 0 - 0 !
1 file changed, 3 insertions(+)

 qbist: define path_max on hurd

Bug-Debian: https://bugs.debian.org/934077

plug-ins/common/file-psp.c | 13 11 + 2 - 0 !
1 file changed, 11 insertions(+), 2 deletions(-)

 plug-ins: fix vulnerabilities in file-psp

plug-ins/file-psd/psd-util.c | 1 1 + 0 - 0 !
1 file changed, 1 insertion(+)

 plug-ins: fix vulnerability in file-psd

plug-ins/file-dds/ddsread.c | 15 15 + 0 - 0 !
1 file changed, 15 insertions(+)

 plug-ins: fix dds vulnerability (zdi-can-22093)

plug-ins/file-dds/ddsread.c | 39 29 + 10 - 0 !
1 file changed, 29 insertions(+), 10 deletions(-)

 plug-ins: fix dds import regression from 7db71cd0

plug-ins/file-dds/ddsread.c | 8 6 + 2 - 0 !
1 file changed, 6 insertions(+), 2 deletions(-)

 plug-ins: additional fixes for dds import

plug-ins/file-dds/ddsread.c | 8 8 + 0 - 0 !
1 file changed, 8 insertions(+)

---

plug-ins/file-fli/fli.c | 2 1 + 1 - 0 !
1 file changed, 1 insertion(+), 1 deletion(-)

 [patch] plug-ins: fix zdi-can-25100 for fli plug-in

Resolves #13073
This patch adds a check to make sure we're not
writing beyond the bounds of the "pos" array.
This is the same check that we do earlier when
writing pos[xc++], but it was left off of the last
write command. Since "n" will be 0 if we get to the
end of the array, it prevents us from writing beyond
that.

plug-ins/common/file-tga.c | 11 2 + 9 - 0 !
1 file changed, 2 insertions(+), 9 deletions(-)

---

plug-ins/common/file-tga.c | 47 23 + 24 - 0 !
1 file changed, 23 insertions(+), 24 deletions(-)

---

plug-ins/common/file-tga.c | 2 1 + 1 - 0 !
1 file changed, 1 insertion(+), 1 deletion(-)

---

plug-ins/common/file-tga.c | 19 17 + 2 - 0 !
1 file changed, 17 insertions(+), 2 deletions(-)

---

app/xcf/xcf-load.c | 18 14 + 4 - 0 !
1 file changed, 14 insertions(+), 4 deletions(-)

---

app/xcf/xcf-load.c | 22 22 + 0 - 0 !
1 file changed, 22 insertions(+)

---

plug-ins/file-ico/ico-load.c | 6 5 + 1 - 0 !
1 file changed, 5 insertions(+), 1 deletion(-)

 [patch] plug-ins: zdi-can-26752 mitigation

Resolves #13910
Since ICO can store PNGs, it's possible to create an
icon that's much larger than the stated image size and
cause a buffer overflow.
This patch adds a check to make sure the width * height * 4
calculation does not overflow in addition to making sure it
doesn't exceed the maximum allowed size for that icon.