From 87acbab960901e459c37996fa9fff4f639bb61d4 Mon Sep 17 00:00:00 2001
From: Funda Wang <fundawang@yeah.net>
Date: Wed, 18 Jun 2025 22:56:20 +0800
Subject: [PATCH] fix CVE-2025-6199

---
 CVE-2025-6199.patch | 30 ++++++++++++++++++++++++++++++
 gdk-pixbuf2.spec    |  9 +++++++--
 2 files changed, 37 insertions(+), 2 deletions(-)
 create mode 100644 CVE-2025-6199.patch

diff --git a/CVE-2025-6199.patch b/CVE-2025-6199.patch
new file mode 100644
index 0000000..e242f83
--- /dev/null
+++ b/CVE-2025-6199.patch
@@ -0,0 +1,30 @@
+From c4986342b241cdc075259565f3fa7a7597d32a32 Mon Sep 17 00:00:00 2001
+From: lumi <lumi@suwi.moe>
+Date: Sat, 7 Jun 2025 22:27:06 +0200
+Subject: [PATCH] lzw: Fix reporting of bytes written in decoder
+
+When the LZW decoder encounters an invalid code, it stops
+processing the image and returns the whole buffer size.
+It should return the amount of bytes written, instead.
+
+Fixes #257
+---
+ gdk-pixbuf/lzw.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/gdk-pixbuf/lzw.c b/gdk-pixbuf/lzw.c
+index 15293560b..4f3dd8beb 100644
+--- a/gdk-pixbuf/lzw.c
++++ b/gdk-pixbuf/lzw.c
+@@ -208,7 +208,7 @@ lzw_decoder_feed (LZWDecoder *self,
+                                 /* Invalid code received - just stop here */
+                                 if (self->code >= self->code_table_size) {
+                                         self->last_code = self->eoi_code;
+-                                        return output_length;
++                                        return n_written;
+                                 }
+ 
+                                 /* Convert codeword into indexes */
+-- 
+GitLab
+
diff --git a/gdk-pixbuf2.spec b/gdk-pixbuf2.spec
index 5f1eead..336bf30 100644
--- a/gdk-pixbuf2.spec
+++ b/gdk-pixbuf2.spec
@@ -2,11 +2,12 @@
 
 Name:           gdk-pixbuf2
 Version:        2.42.12
-Release:        1
+Release:        2
 Summary:        gdk is a multi-platform toolkit for creating graphical user interfaces.
 License:        LGPL-2.1-or-later
 URL:            https://gitlab.gnome.org/GNOME/gdk-pixbuf
 Source0:        https://download.gnome.org/sources/gdk-pixbuf/2.42/gdk-pixbuf-%{version}.tar.xz
+Patch6001:      CVE-2025-6199.patch
 
 BuildRequires:  docbook-style-xsl
 BuildRequires:  gettext
@@ -21,7 +22,7 @@ BuildRequires:  libxslt
 BuildRequires:  meson >= 0.55.3
 BuildRequires:  pkgconfig(gobject-introspection-1.0)
 BuildRequires:  shared-mime-info
-BuildRequires:  cmake gi-docgen python3-docutils
+BuildRequires:  gi-docgen python3-docutils
 
 Requires:       glib2%{?_isa} >= %{glib2_version}
 Requires:       shared-mime-info
@@ -125,6 +126,10 @@ gdk-pixbuf-query-loaders-%{__isa_bits} --update-cache
 %doc %{_datadir}/doc/gdk-pixdata/
 
 %changelog
+* Mon Mar 03 2025 Funda Wang <fundawang@yeah.net> - 2.42.12-2
+- fix CVE-2025-6199
+- drop useless cmake build dependency
+
 * Wed Oct 16 2024 Funda Wang <fundawang@yeah.net> - 2.42.12-1
 - update to 2.42.12
 
-- 
Gitee