REDHAT-BUG-2554456: Integer Overflow

GIMP ships a plug-in (file-paa) that loads textures stored in the Bohemia Interactive PAA texture format. The loader computes the size of an intermediate decompression buffer with a 32-bit multiplication on the width × height × bytes-per-pixel value extracted from the file header. For specific 16-bit dimension pairs (e.g. width=32 768, height=32 769) the product overflows a 32-bit unsigned integer and wraps to a small value (131 072 bytes in the demonstrated case). GIMP allocates the wrapped (small) size, fills it with decompressed data, and then commits the buffer to a GEGL pixel buffer using the original (large) width × height rectangle. GEGL therefore reads gigabytes past the end of the heap allocation through memcpy, dereferencing unmapped memory and crashing the plug-in process. Triggering the vulnerability requires only that the user (or an automated preview/thumbnail consumer) open or peek at a crafted .paa file — for example by double-clicking the file, dragging it into GIMP, or by an indexer/file manager that runs GIMP's thumbnailer. The immediate observable effect is a reliable crash of the GIMP plug-in process (denial of service of the load operation, image data lost). Because the out-of-bounds read precedes the crash and copies adjacent heap memory into pixel data committed to a GEGL buffer, the bug also has the potential to disclose contents of the plug-in's heap through any pixel data that is rendered, exported, or copied to the clipboard before the read walks off the end of mapped memory. CWE-190 (Integer Overflow or Wraparound) leading to CWE-125 (Out-of-bounds Read).