A double-free vulnerability exists in GIMP's Paint Shop Pro (PSP) file format parser. In readlayerblock() in file-psp.c, the variable name is allocated, used, and freed each loop iteration. On the error path in the 2nd iteration, fread fails before gmalloc for name, so the stale pointer from iteration 1 is freed again via gfree(name).

- Function: readlayerblock() - File: plug-ins/common/file-psp.c:1908-2321 - Fix: https://gitlab.gnome.org/GNOME/gimp/-/commit/b22e147b - Upstream issue: https://gitlab.gnome.org/GNOME/gimp/-/issues/16207 - Acknowledgment: bb1abu